Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability, CVE-2026-75856, is an SSRF bypass in CodeWhale's fetch_url tool, caused by a Time-of-Check to Time-of-Use (TOCTOU) flaw in its DNS pinning logic. The root cause lies in how the application handled DNS resolution failures during its preflight check. The analysis of the fixing commit, 26de44a8bd5051f8f944ea60b2c37ae1d2b7d25e, reveals that the function tui::tools::fetch_url::validate_fetch_target was the source of the vulnerability. In its vulnerable state, if the initial DNS lookup failed, the function would not raise an error and would instead allow the operation to proceed, assuming the subsequent HTTP request would also fail. This created a race condition that a malicious DNS server could exploit: first, by failing the preflight DNS check, and second, by successfully resolving the domain to an internal IP address during the actual HTTP request. The patch corrects this by ensuring that any failure during the initial DNS lookup immediately terminates the operation and returns an error, thus closing the TOCTOU window.
tui::tools::fetch_url::validate_fetch_targetcrates/tui/src/tools/fetch_url.rs
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| deepseek-tui | rust | >= 0.8.5, <= 0.8.41 | |
| deepseek-tui | npm | >= 0.8.5, < 0.8.41 | 0.8.41 |
| codewhale-tui | rust | >= 0.8.41, < 0.8.64 | 0.8.64 |
| codewhale | npm | >= 0.8.41, < 0.8.64 | 0.8.64 |