Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
CodeWhale is a DeepSeek + MiMo coding agent in terminal. Prior to 0.8.22, the fetch_url tool validates the initial URL's resolved IP address against a restricted-IP blocklist (is_restricted_ip()) to prevent SSRF attacks against internal services (cloud metadata endpoints, localhost, private networks). However, the HTTP client (reqwest) is configured to automatically follow up to 5 redirects (reqwest::redirect::Policy::limited(5)) without re-validating the redirect target against the same SSRF protections. This vulnerability is fixed in 0.8.22.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-45310 CodeWhale is a DeepSeek + MiMo coding agent in terminal. Prior to 0.8.22, the fetch_url tool validates the initial URL's resolved IP address against a restricted-IP b… https://www.cve.org/CVERecord?id=CVE-2026-45310
Post summary
The passage briefly references CVE‑2026‑45310 and mentions old validation behavior of CodeWhale’s fetch_url tool, but offers no concrete details on exploitation, patches, or vulnerability specifics.
CVE-2026-45310 Server-Side Request Forgery via Unvalidated HTTP Redirects in CodeWhale Before 0.8.22 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-45310
Post summary
The notice announces a new SSRF vulnerability in CodeWhale (CVE-2026-45310) with affected versions specified, but provides no PoC, exploit code, active exploitation details, or mitigation guidance.