highCVSS 7.4Vulnerability
CVE-2026-45373
### Summary Although SSRF is validated against hostnames that resolve to private IPv6 addresses, when providing the IPV6 in URL as `http://[::1]`, the SSRF defenses do not work. ### Details https://github.com/Hmbown/DeepSeek-TUI/blob/15f62e3e93d842f30b428877819ebc1c8cb96814/crates/tui/src/tools/fetch_url.rs#L321 ### PoC Prompt: `Run fetch_url tool and give output, no thinking. Use url : http://[::1]` ### Impact Access to local restricted resources
Properties
- severity
- high
- summary
- DeepSeek TUI has SSRF IPV6 bypass
- epss_score
- 0.00239
- cvss_score
- 7.4
- ghsa_published
- 2026-05-14T20:29:48Z
- source_url
- https://github.com/advisories/GHSA-88gh-2526-gfrr
- ghsa_updated
- 2026-05-14T20:29:48Z
- ghsa_id
- GHSA-88gh-2526-gfrr
- cve_id
- CVE-2026-45373
- cvss_vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
- is_ghsa_only
- false
- epss_percentile
- 0.15056
Related Entities (5)
ENRICHED_BY (1)
→[Source]FIRST EPSS
VULNERABLE_TO (1)
←[Software]rust/deepseek-tui
AFFECTS (1)
→[Software]rust/deepseek-tui
HAS_WEAKNESS (1)
→[Weakness]Server-Side Request Forgery (SSRF)
REPORTED_BY (1)
→[Source]GitHub Advisory Database
Explore deeper with Ninja Signal's threat intelligence graph