Hmbown

CodeWhale before 0.8.64 contains a server-side request forgery bypass vulnerability in DNS pinning logic that fails to prevent time-of-check-time-of-use attacks.

CodeWhale versions before 0.8.64 contain an environment variable exposure vulnerability in the js_execution tool that fails to scrub parent process environment variables before spawning Node.js.

CodeWhale is a DeepSeek + MiMo coding agent in terminal.

CodeWhale is a DeepSeek + MiMo coding agent in terminal.

CodeWhale versions >= 0.3.27 and < 0.8.64 (published as deepseek-tui >= 0.3.27 and < 0.8.41 on npm and 0.3.27 through 0.8.41 on crates.io, and as codewhale / codewhale-tui >= 0.8.41 and < 0.8.64) contain an argument inje…

CodeWhale versions before 0.8.64 fail to properly validate the allow_shell configuration parameter from project config files, allowing attackers to enable arbitrary shell command execution by committing a malicious .code…

CodeWhale (packages codewhale / codewhale-tui) versions >= 0.8.41 and < 0.8.64 contain a remote code execution vulnerability in the rlm_eval tool.

CodeWhale versions before 0.8.64 contain an argument injection vulnerability in the git_blame tool that allows attackers to read arbitrary files by injecting git options into the unvalidated rev parameter.

CodeWhale is a DeepSeek + MiMo coding agent in terminal.

CodeWhale versions >= 0.3.10 and < 0.8.64 (published as deepseek-tui >= 0.3.10 and < 0.8.41 on npm and 0.3.10 through 0.8.41 on crates.io, and as codewhale / codewhale-tui >= 0.8.41 and < 0.8.64) contain a vulnerability…

CodeWhale is a DeepSeek + MiMo coding agent in terminal.

CodeWhale versions before 0.8.64 contain a path traversal vulnerability in the image_analyze tool that fails to canonicalize symlinks before reading files.

CodeWhale versions before 0.8.64 fail to validate file paths in the project config instructions field, allowing attackers to read arbitrary files on the victim's system.