Skip to main content
cve.nowby Sazabi
← npm
npmPackage

deepseek-tui

11 known vulnerabilities (2 critical, 9 high), with the versions each affects and the releases that fix them.

Latest release
0.8.47 (May 27, 2026): no advisory affects it
Newest unaffected release
Every release is affected by at least one advisory
Advisories
11 · 2 critical, 9 high
Weekly downloads
805
Dependents
0
Releases
59 since 0.3.28 (Mar 3, 2026)
Registry
npm
Releases read
Nov 8, 2026

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 11

  • CodeWhale before 0.8.64 Environment Variable Leak via js_execution

    Affected: from 0.8.32, fixed in 0.8.41.

    Fixed in 0.8.41 (released May 23, 2026, 87 days before disclosure).

    The latest release, 0.8.47, is not affected.

    4.3% of deepseek-tui downloads last week were affected versions (26).

  • CodeWhale before 0.8.64 Path Traversal via image_analyze symlink

    Affected: from 0.8.32, fixed in 0.8.41.

    Fixed in 0.8.41 (released May 23, 2026, 87 days before disclosure).

    The latest release, 0.8.47, is not affected.

    4.3% of deepseek-tui downloads last week were affected versions (26).

  • CodeWhale before 0.8.64 Argument Injection via git_show

    Affected: from 0.3.27, fixed in 0.8.41.

    Fixed in 0.8.41 (released May 23, 2026, 87 days before disclosure).

    The latest release, 0.8.47, is not affected.

    12% of deepseek-tui downloads last week were affected versions (70).

  • CodeWhale before 0.8.64 Argument Injection via git_blame

    Affected: from 0.3.27, fixed in 0.8.41.

    Fixed in 0.8.41 (released May 23, 2026, 87 days before disclosure).

    The latest release, 0.8.47, is not affected.

    12% of deepseek-tui downloads last week were affected versions (70).

  • CodeWhale before 0.8.64 Remote Code Execution via allow_shell

    Affected: from 0.8.6, fixed in 0.8.41.

    Fixed in 0.8.41 (released May 23, 2026, 87 days before disclosure).

    The latest release, 0.8.47, is not affected.

    11% of deepseek-tui downloads last week were affected versions (68).

  • CodeWhale before 0.8.64 Arbitrary File Read via instructions

    Affected: from 0.8.8, fixed in 0.8.41.

    Fixed in 0.8.41 (released May 23, 2026, 87 days before disclosure).

    The latest release, 0.8.47, is not affected.

    11% of deepseek-tui downloads last week were affected versions (68).

  • CodeWhale rlm_eval before 0.8.64 Remote Code Execution

    Affected: from 0.8.33, fixed in 0.8.41.

    Fixed in 0.8.41 (released May 23, 2026, 87 days before disclosure).

    The latest release, 0.8.47, is not affected.

    4.3% of deepseek-tui downloads last week were affected versions (26).

  • CodeWhale before 0.8.64 Privilege Escalation via exec_shell_interact

    Affected: from 0.3.10, fixed in 0.8.41.

    Fixed in 0.8.41 (released May 23, 2026, 87 days before disclosure).

    The latest release, 0.8.47, is not affected.

    12% of deepseek-tui downloads last week were affected versions (70).

  • CVE-2026-75856Critical 9.2

    CodeWhale before 0.8.64 SSRF Bypass via DNS Pinning TOCTOU

    Affected: from 0.8.5, fixed in 0.8.41.

    Fixed in 0.8.41 (released May 23, 2026, 87 days before disclosure).

    The latest release, 0.8.47, is not affected.

    11% of deepseek-tui downloads last week were affected versions (68).

  • CVE-2026-45311Critical 9.6

    CodeWhale: run_tests Tool Enables RCE via Malicious Repository Without Approval

    Affected: from 0.3.0, fixed in 0.8.23.

    Fixed in 0.8.23 (released May 9, 2026, 19 days before disclosure).

    The latest release, 0.8.47, is not affected.

    6.9% of deepseek-tui downloads last week were affected versions (41).

  • CodeWhale: SSRF via HTTP Redirect Bypass in fetch_url Tool

    Affected: fixed in 0.8.22.

    Fixed in 0.8.22 (released May 8, 2026, 20 days before disclosure).

    The latest release, 0.8.47, is not affected.

    6.4% of deepseek-tui downloads last week were affected versions (38).