Description
CodeWhale before 0.8.64 contains a server-side request forgery bypass vulnerability in DNS pinning logic that fails to prevent time-of-check-time-of-use attacks. Attackers can manipulate DNS responses to fail initial resolution checks and succeed on secondary requests, allowing requests to internal IP addresses and bypassing SSRF mitigations.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Hmbown CodeWhale
Default version status: unaffected
0.8.5 to < 0.8.41affected0.8.41unaffected
pkg:cargo/deepseek-tuiHmbown CodeWhale
Default version status: unaffected
0.8.5 to < 0.8.41affected0.8.41unaffected
pkg:npm/deepseek-tuiHmbown CodeWhale
Default version status: unaffected
0.8.41 to < 0.8.64affected0.8.64unaffected
pkg:cargo/codewhale-tuiHmbown CodeWhale
Default version status: unaffected
0.8.41 to < 0.8.64affected0.8.64unaffected
pkg:npm/codewhale