CVE-2026-45373

7.4 Élevée

Publiée le 28/05/2026 à 20:16 · Modifiée le 17/06/2026 à 12:51 · Analyse NVD reportée · Source : security-advisories@github.com

Description

CodeWhale is a DeepSeek + MiMo coding agent in terminal. Prior to 0.8.26, although SSRF is validated against hostnames that resolve to private IPv6 addresses, when providing the IPV6 in‌‌ URL‌ as http://[::1], the SSRF defenses do not work. This vulnerability is fixed in 0.8.26.

Traduire en français

Produits concernés

Hmbown CodeWhale

Scores CVSS

Version	Score	Source	Vecteur
3.1	7.4 Élevée	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N`

Faiblesses (CWE)

CWE-918

Références

https://github.com/Hmbown/CodeWhale/security/advisories/GHSA-88gh-2526-gfrr
https://github.com/Hmbown/DeepSeek-TUI/blob/15f62e3e93d842f30b428877819ebc1c8cb96814/crates/tui/src/tools/fetch_url.rs#L321
https://github.com/Hmbown/DeepSeek-TUI/releases/tag/v0.8.26
https://github.com/Hmbown/CodeWhale/security/advisories/GHSA-88gh-2526-gfrr

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories