{"id":"EUVD-2026-32964","revision":"9c26858ab4a94cf69a3436cb5bc071d0","records":[{"revision":"9c26858ab4a94cf69a3436cb5bc071d0","observedAt":"2026-10-28T06:11:04.765+00:00","statement":{"source":"euvd","id":"EUVD-2026-32964","aliases":["CVE-2026-45310","GHSA-96ff-gc8g-wpvg"],"title":"CodeWhale is a DeepSeek + MiMo coding agent in terminal. Prior to 0.8.22, the fetch_url tool validates the initial URL's resolved IP address against a restricted-IP blocklist (is_restricted_ip()) to prevent SSRF attacks against internal ser…","description":"CodeWhale is a DeepSeek + MiMo coding agent in terminal. Prior to 0.8.22, the fetch_url tool validates the initial URL's resolved IP address against a restricted-IP blocklist (is_restricted_ip()) to prevent SSRF attacks against internal services (cloud metadata endpoints, localhost, private networks). However, the HTTP client (reqwest) is configured to automatically follow up to 5 redirects (reqwest::redirect::Policy::limited(5)) without re-validating the redirect target against the same SSRF protections. This vulnerability is fixed in 0.8.22.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N","score":7.4,"severity":null}],"references":["https://github.com/Hmbown/CodeWhale/security/advisories/GHSA-96ff-gc8g-wpvg","https://github.com/Hmbown/DeepSeek-TUI/releases/tag/v0.8.22"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-32964","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"May 28, 2026, 5:30:09 PM","dateUpdated":"May 30, 2026, 2:09:17 AM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-32964","identifiers":["EUVD-2026-32964","CVE-2026-45310","GHSA-96ff-gc8g-wpvg"]},"retained":false,"historicalAffected":[]}],"coverage":[]}