GHSA-96ff-gc8g-wpvg
High · 7.4CVSS
7.4
EPSS
—
Published
May 14, 2026
CISA due date
—
The record
DeepSeek TUI has SSRF via HTTP Redirect Bypass in fetch_url Tool
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| crates.io | deepseek-tui | 0 | 0.8.22 |
| crates.io | deepseek-tui-cli | 0 | 0.8.22 |
| npm | deepseek-tui | 0 | 0.8.22 |
Related vulnerabilities
- CVE-2026-45310 CodeWhale is a DeepSeek + MiMo coding agent in terminal. Same vulnerability
- CVE-2026-45311 CodeWhale is a DeepSeek + MiMo coding agent in terminal. Also affects deepseek-tui
- CVE-2026-45374 CodeWhale is a DeepSeek + MiMo coding agent in terminal. Also affects deepseek-tui
- CVE-2026-45373 CodeWhale is a DeepSeek + MiMo coding agent in terminal. Also affects deepseek-tui
- GHSA-72w5-pf8h-xfp4 DeepSeek TUI: task_create Insecure Defaults Enable RCE via Prompt Injection in Project… Also affects deepseek-tui
- GHSA-88gh-2526-gfrr DeepSeek TUI has SSRF IPV6 bypass Also affects deepseek-tui
- GHSA-wx44-2q6h-j6p8 DeepSeek TUI: run_tests Tool Enables RCE via Malicious Repository Without Approval Also affects deepseek-tui
- CVE-2026-114730 Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a… CWE-918