EUVD-2026-60963
GHSA-6v2g-fpxh-pmmh
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable and unauthenticated (PR:N), but reliable exploitation needs DNS control and a TOCTOU race (AC:H); SSRF reaches other internal systems (S:C) exposing data (C:H) with no integrity/availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
CodeWhale before 0.8.64 contains a server-side request forgery bypass vulnerability in DNS pinning logic that fails to prevent time-of-check-time-of-use attacks. Attackers can manipulate DNS responses to fail initial resolution checks and succeed on secondary requests, allowing requests to internal IP addresses and bypassing SSRF mitigations.
AnalysisAI
Server-side request forgery in CodeWhale before 0.8.64 lets remote attackers reach internal-only IP addresses through the agent's fetch_url tool by exploiting a time-of-check-time-of-use gap in its DNS-pinning defense. Because the pre-fetch validator treated a failed DNS lookup as a pass-through ('let the HTTP request proceed and fail naturally'), an attacker who controls DNS responses can make the safety check see a non-resolving or benign answer while the real request resolves to an internal address, bypassing the SSRF allow/deny policy. No public exploit identified at time of analysis; a vendor patch and fix commit exist, and the issue was reported by VulnCheck.
Technical ContextAI
CodeWhale is a Rust-based terminal AI coding agent (code under crates/tui). Its fetch_url tool is supposed to prevent SSRF by resolving the target host and validating each resolved IP against a network policy (validate_dns_resolved_ip) before making the outbound HTTP request - a DNS-pinning pattern. The root cause is CWE-918 (SSRF) manifesting as a TOCTOU flaw: the vulnerable validate_fetch_target wrapped resolution in if let Ok(addrs), so when the preflight lookup failed it fell through and returned an un-pinned target (Ok(None)), and the comment explicitly deferred to letting the HTTP layer resolve again later. Between the check and the use, DNS can return different data (classic DNS rebinding / response manipulation), so the enforced IP need not match the fetched IP. The patched code makes a failed lookup a hard permission_denied error and requires at least one validated address before proceeding.
RemediationAI
Vendor-released patch: upgrade to CodeWhale 0.8.64 or later, which changes validate_fetch_target to reject hosts that fail DNS preflight and to require a validated resolved address before any fetch (fix commit 26de44a8bd5051f8f944ea60b2c37ae1d2b7d25e; advisory GHSA-6v2g-fpxh-pmmh). If you cannot upgrade immediately, restrict the agent's outbound network path: run CodeWhale behind an egress proxy or firewall that denies traffic to RFC1918/link-local ranges (notably 169.254.169.254 cloud metadata, 127.0.0.0/8, 10/8, 172.16/12, 192.168/16), which neutralizes the SSRF target set at the cost of blocking any legitimate internal fetches; and constrain or disable the fetch_url tool for untrusted sessions, accepting reduced functionality. These controls compensate for the TOCTOU by enforcing the internal-IP block at the network boundary rather than inside the resolver.
Environment variable inheritance in CodeWhale's js_execution tool prior to version 0.8.64 allows crafted JavaScript payl
Unauthenticated file disclosure in CodeWhale before 0.8.64 allows arbitrary local file reads via the image_analyze tool'
Arbitrary file read in CodeWhale before version 0.8.64 allows an attacker to exfiltrate files from a developer's worksta
Argument injection in CodeWhale's git_show tool (versions 0.8.41-0.8.63) allows an attacker to cause arbitrary file writ
Remote code execution in CodeWhale (packages codewhale and codewhale-tui) versions 0.8.41 through 0.8.63 allows an attac
Shell command injection in CodeWhale before version 0.8.64 enables arbitrary code execution on a victim developer's mach
Argument injection in CodeWhale versions before 0.8.64 exposes arbitrary files on the host system by accepting unsanitiz
Prompt-injection-driven privilege escalation in CodeWhale 0.8.41-0.8.63 allows an attacker who can place malicious instr
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today