Description
CodeWhale before 0.8.64 contains a server-side request forgery bypass vulnerability in DNS pinning logic that fails to prevent time-of-check-time-of-use attacks. Attackers can manipulate DNS responses to fail initial resolution checks and succeed on secondary requests, allowing requests to internal IP addresses and bypassing SSRF mitigations.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Hmbown | CodeWhale | 0.8.5 – < 0.8.41, 0.8.41 – < 0.8.64 | 0.8.41 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| crates.io | codewhale-tui | >= 0.8.41, < 0.8.64 | 0.8.64 | GHSA-6v2g-fpxh-pmmh |
| crates.io | deepseek-tui | >= 0.8.5, <= 0.8.41 | — | GHSA-6v2g-fpxh-pmmh |
| npm | codewhale | >= 0.8.41, < 0.8.64 | 0.8.64 | GHSA-6v2g-fpxh-pmmh |
| npm | deepseek-tui | >= 0.8.5, < 0.8.41 | 0.8.41 | GHSA-6v2g-fpxh-pmmh |
References
- GitHub Security Advisory (GHSA-6v2g-fpxh-pmmh) vendor-advisory
- Patch Commit patch
- VulnCheck Advisory: CodeWhale before 0.8.64 SSRF Bypass via DNS Pinning TOCTOU third-party-advisory