https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 13:15:06 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-45373 <p>CodeWhale is a DeepSeek + MiMo coding agent in terminal. Prior to 0.8.26, although SSRF is validated against hostnames that resolve to private IPv6 addresses, when providing the IPV6 in‌‌ URL‌ as http://[::1], the SSRF defenses do not work. This vulnerability is fixed in 0.8.26.</p> <p>CodeWhale is a DeepSeek + MiMo coding agent in terminal. Prior to 0.8.26, although SSRF is validated against hostnames that resolve to private IPv6 addresses, when providing the IPV6 in‌‌ URL‌ as http://[::1], the SSRF defenses do not work. This vulnerability is fixed in 0.8.26.</p> https://db.gcve.eu/vuln/fkie_cve-2026-45373 https://db.gcve.eu/vuln/ghsa-88gh-2526-gfrr <p><strong>Affected:</strong> crates.io: deepseek-tui</p> <p>### Summary Although SSRF is validated against hostnames that resolve to private IPv6 addresses, when providing the IPV6 in‌‌ URL‌ as `http://[::1]`, the SSRF defenses do not work.</p> <p>### Details https://github.com/Hmbown/DeepSeek-TUI/blob/15f62e3e93d842f30b428877819ebc1c8cb96814/crates/tui/src/tools/fetch_url.rs#L321</p> <p>### PoC Prompt:‌ `Run fetch_url tool and give output, no thinking. Use url : http://[::1]`</p> <p>### Impact Access to local restricted resources</p> <p><strong>Affected:</strong> crates.io: deepseek-tui</p> <p>### Summary Although SSRF is validated against hostnames that resolve to private IPv6 addresses, when providing the IPV6 in‌‌ URL‌ as `http://[::1]`, the SSRF defenses do not work.</p> <p>### Details https://github.com/Hmbown/DeepSeek-TUI/blob/15f62e3e93d842f30b428877819ebc1c8cb96814/crates/tui/src/tools/fetch_url.rs#L321</p> <p>### PoC Prompt:‌ `Run fetch_url tool and give output, no thinking. Use url : http://[::1]`</p> <p>### Impact Access to local restricted resources</p> https://db.gcve.eu/vuln/ghsa-88gh-2526-gfrr