High severity8.6NVD Advisory· Published Aug 18, 2026· Updated Sep 8, 2026
CVE-2026-75856
CVE-2026-75856
Description
CodeWhale before 0.8.64 contains a server-side request forgery bypass vulnerability in DNS pinning logic that fails to prevent time-of-check-time-of-use attacks. Attackers can manipulate DNS responses to fail initial resolution checks and succeed on secondary requests, allowing requests to internal IP addresses and bypassing SSRF mitigations.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
deepseek-tuicrates.io | >= 0.8.5, <= 0.8.41 | — |
deepseek-tuinpm | >= 0.8.5, < 0.8.41 | 0.8.41 |
codewhale-tuicrates.io | >= 0.8.41, < 0.8.64 | 0.8.64 |
codewhalenpm | >= 0.8.41, < 0.8.64 | 0.8.64 |
Affected products
2Patches
Vulnerability mechanics
References
5- github.com/advisories/GHSA-6v2g-fpxh-pmmhghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-75856ghsaADVISORY
- github.com/Hmbown/CodeWhale/commit/26de44a8bd5051f8f944ea60b2c37ae1d2b7d25envdWEB
- github.com/Hmbown/CodeWhale/security/advisories/GHSA-6v2g-fpxh-pmmhnvdWEB
- www.vulncheck.com/advisories/codewhale-before-ssrf-bypass-via-dns-pinning-toctounvdWEB
News mentions
0No linked articles in our index yet.