CVE-2026-45310 Details
Description
CodeWhale is a DeepSeek + MiMo coding agent in terminal. Prior to 0.8.22, the fetch_url tool validates the initial URL's resolved IP address against a restricted-IP blocklist (is_restricted_ip()) to prevent SSRF attacks against internal services (cloud metadata endpoints, localhost, private networks). However, the HTTP client (reqwest) is configured to automatically follow up to 5 redirects (reqwest::redirect::Policy::limited(5)) without re-validating the redirect target against the same SSRF protections. This vulnerability is fixed in 0.8.22.
A server-side request forgery (SSRF) vulnerability has been identified in CodeWhale, a DeepSeek + MiMo coding agent for the terminal, in versions prior to 0.8.22. The issue arises in the fetch_url tool, which initially validates URLs against a restricted-IP blocklist to prevent SSRF attacks on internal services, such as cloud metadata endpoints and private networks. However, the HTTP client used in fetch_url is set to automatically follow redirects without re-checking the redirect target against the same SSRF protections. This flaw allows an attacker to bypass the SSRF safeguards and access restricted internal services.
Users can update to CodeWhale version 0.8.22 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 28, 2026CISA-ADP
Assessed May 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Hmbown/CodeWhale/security/advisories/GHSA-96ff-gc8g-wpvg | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/Hmbown/CodeWhale/security/advisories/GHSA-96ff-gc8g-wpvg | [email protected] | AdvisoryExploitRemedyVendor |
| https://github.com/Hmbown/DeepSeek-TUI/releases/tag/v0.8.22 | [email protected] | Release NotesVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Hmbown CodeWhale | < 0.8.22 (semver) |
CPE
Remediation
| |
| Hmbown DeepSeek-TUI | All versions |
CPE
Remediation
| |
| Hmbown DeepSeek-TUI-CLI | All versions |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 30, 2026 | CVE Modified | CISA-ADP |
| May 28, 2026 | New CVE Received | [email protected] |