CVE-2026-45373
High · 7.4CVSS
7.4
EPSS
0.4%
Published
May 28, 2026
CISA due date
—
The record
CodeWhale is a DeepSeek + MiMo coding agent in terminal. Prior to 0.8.26, although SSRF is validated against hostnames that resolve to private IPv6 addresses, when providing the IPV6 in URL as http://[::1], the SSRF defenses do not work. This vulnerability is fixed in 0.8.26.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| crates.io | deepseek-tui | 0 | 0.8.26 |
Related vulnerabilities
- GHSA-88gh-2526-gfrr DeepSeek TUI has SSRF IPV6 bypass Same vulnerability
- CVE-2026-45310 CodeWhale is a DeepSeek + MiMo coding agent in terminal. Also affects deepseek-tui
- CVE-2026-45311 CodeWhale is a DeepSeek + MiMo coding agent in terminal. Also affects deepseek-tui
- CVE-2026-45374 CodeWhale is a DeepSeek + MiMo coding agent in terminal. Also affects deepseek-tui
- GHSA-72w5-pf8h-xfp4 DeepSeek TUI: task_create Insecure Defaults Enable RCE via Prompt Injection in Project… Also affects deepseek-tui
- GHSA-wx44-2q6h-j6p8 DeepSeek TUI: run_tests Tool Enables RCE via Malicious Repository Without Approval Also affects deepseek-tui
- GHSA-96ff-gc8g-wpvg DeepSeek TUI has SSRF via HTTP Redirect Bypass in fetch_url Tool Also affects deepseek-tui
- CVE-2026-114730 Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a… CWE-918