# deepseek-tui (crates.io) vulnerabilities 13 known vulnerabilities (3 critical, 10 high), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 0.8.41 (Jul 28, 2026): affected by 9 advisories - Newest unaffected release: Every release is affected by at least one advisory - Weekly downloads: 48 - Dependents: 0 - Releases: 73 since 0.0.1 (Jan 19, 2026) - Registry: https://crates.io/crates/deepseek-tui - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-75915: 0.8.32 to 0.8.41 (through the newest release) - CVE-2026-75914: 0.8.32 to 0.8.41 (through the newest release) - CVE-2026-75913: 0.3.27 to 0.8.41 (through the newest release) - CVE-2026-75912: 0.3.27 to 0.8.41 (through the newest release) - CVE-2026-75911: 0.8.7 to 0.8.41 (through the newest release) - CVE-2026-75859: 0.8.8 to 0.8.41 (through the newest release) - CVE-2026-75858: 0.8.33 to 0.8.41 (through the newest release) - CVE-2026-75857: 0.3.10 to 0.8.41 (through the newest release) - CVE-2026-75856: 0.8.7 to 0.8.41 (through the newest release) - CVE-2026-45311: 0.3.1 to 0.8.22 (0.8.23 is outside it) - CVE-2026-45310: 0.0.1 to 0.8.21 (0.8.22 is outside it) - CVE-2026-45373: 0.0.1 to 0.8.25 (0.8.26 is outside it) - CVE-2026-45374: 0.0.1 to 0.8.25 (0.8.26 is outside it) ## Advisories (13) ### [CVE-2026-75915](https://cve.now/CVE-2026-75915): CodeWhale before 0.8.64 Environment Variable Leak via js\_execution - Severity: High 8.7 - Published: Aug 18, 2026 - Affected: from 0.8.32, through 0.8.41. - No fix released. The latest release, 0.8.41, is still affected. ### [CVE-2026-75914](https://cve.now/CVE-2026-75914): CodeWhale before 0.8.64 Path Traversal via image\_analyze symlink - Severity: High 8.7 - Published: Aug 18, 2026 - Affected: from 0.8.32, through 0.8.41. - No fix released. The latest release, 0.8.41, is still affected. ### [CVE-2026-75913](https://cve.now/CVE-2026-75913): CodeWhale before 0.8.64 Argument Injection via git\_show - Severity: High 8.5 - Published: Aug 18, 2026 - Affected: from 0.3.27, through 0.8.41. - No fix released. The latest release, 0.8.41, is still affected. ### [CVE-2026-75912](https://cve.now/CVE-2026-75912): CodeWhale before 0.8.64 Argument Injection via git\_blame - Severity: High 8.3 - Published: Aug 18, 2026 - Affected: from 0.3.27, through 0.8.41. - No fix released. The latest release, 0.8.41, is still affected. ### [CVE-2026-75911](https://cve.now/CVE-2026-75911): CodeWhale before 0.8.64 Remote Code Execution via allow\_shell - Severity: High 8.5 - Published: Aug 18, 2026 - Affected: from 0.8.6, through 0.8.41. - No fix released. The latest release, 0.8.41, is still affected. ### [CVE-2026-75859](https://cve.now/CVE-2026-75859): CodeWhale before 0.8.64 Arbitrary File Read via instructions - Severity: High 8.7 - Published: Aug 18, 2026 - Affected: from 0.8.8. - No fix released. The latest release, 0.8.41, is still affected. ### [CVE-2026-75858](https://cve.now/CVE-2026-75858): CodeWhale rlm\_eval before 0.8.64 Remote Code Execution - Severity: High 8.5 - Published: Aug 18, 2026 - Affected: from 0.8.33, through 0.8.41. - No fix released. The latest release, 0.8.41, is still affected. ### [CVE-2026-75857](https://cve.now/CVE-2026-75857): CodeWhale before 0.8.64 Privilege Escalation via exec\_shell\_interact - Severity: High 7.3 - Published: Aug 18, 2026 - Affected: from 0.3.10, through 0.8.41. - No fix released. The latest release, 0.8.41, is still affected. ### [CVE-2026-75856](https://cve.now/CVE-2026-75856): CodeWhale before 0.8.64 SSRF Bypass via DNS Pinning TOCTOU - Severity: Critical 9.2 - Published: Aug 18, 2026 - Affected: from 0.8.5, through 0.8.41. - No fix released. The latest release, 0.8.41, is still affected. ### [CVE-2026-45311](https://cve.now/CVE-2026-45311): CodeWhale: run\_tests Tool Enables RCE via Malicious Repository Without Approval - Severity: Critical 9.6 - Published: May 28, 2026 - Affected: from 0.3.0, fixed in 0.8.23. - Fixed in 0.8.23 (released May 9, 2026, 19 days before disclosure). - The latest release, 0.8.41, is not affected. ### [CVE-2026-45310](https://cve.now/CVE-2026-45310): CodeWhale: SSRF via HTTP Redirect Bypass in fetch\_url Tool - Severity: High 7.4 - Published: May 28, 2026 - Affected: fixed in 0.8.22. - Fixed in 0.8.22 (released May 8, 2026, 20 days before disclosure). - The latest release, 0.8.41, is not affected. ### [CVE-2026-45373](https://cve.now/CVE-2026-45373): CodeWhale: SSRF‌ IPV6 bypass - Severity: High 7.4 - Published: May 28, 2026 - Affected: fixed in 0.8.26. - Fixed in 0.8.26 (released May 10, 2026, 18 days before disclosure). - The latest release, 0.8.41, is not affected. ### [CVE-2026-45374](https://cve.now/CVE-2026-45374): CodeWhale: task\_create Insecure Defaults Enable RCE via Prompt Injection in Project Files - Severity: Critical 9.6 - Published: May 28, 2026 - Affected: fixed in 0.8.26. - Fixed in 0.8.26 (released May 10, 2026, 18 days before disclosure). - The latest release, 0.8.41, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/crates.io/deepseek-tui Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.