Nine advisories land on CodeWhale in one day, including a critical SSRF bypass that beats DNS pinning via a TOCTOU on resolution failure
GitHub published nine advisories for the CodeWhale coding agent TUI (shipped as deepseek-tui / codewhale on npm and crates.io) on 2026-09-04, spanning CVSS 7.0 to 9.3. The headline critical (GHSA-6v2g-fpxh-pmmh, CVSS 8.6, CVE-2026-75856) exploits the agent's DNS-pinning code allowing execution to continue when a lookup fails: an attacker-run resolver fails the first A/AAAA queries, then answers 127.0.0.1 on the retry, and fetch_url reads localhost. The rest are the now-familiar coding-agent pattern, argument injection in git_blame and git_show giving unapproved file read and write, project-config allow_shell and instructions overrides that a cloned repo can set, rlm_eval auto-approving Python, and image_analyze following workspace symlinks. Fixed in 0.8.64.
↳ Follow the thread