HighVulnerabilityLLM-specific
GHSA-96ff-gc8g-wpvg: DeepSeek TUI has SSRF via HTTP Redirect Bypass in fetch_url Tool
- Identifiers
- CVE-2026-45310GHSA-96ff-gc8g-wpvg
- Published
- Record updated
- Affected
- deepseek-tui < 0.8.22
- deepseek-tui-cli < 0.8.22
- Fixed in
- 0.8.22
- deepseek-tui 0.8.22 released May 8, 2026, 6 days before disclosure
- deepseek-tui-cli 0.8.22 released May 8, 2026, 6 days before disclosure
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.3%
Summary
DeepSeek TUI's fetch_url tool checks the initial URL's resolved IP against an is_restricted_ip() blocklist, but its reqwest HTTP client follows up to five redirects without re-validating each target. A public URL that redirects to 169.254.169.254 therefore reaches the restricted address, and the researcher confirmed a 302 redirect was followed to that IP and to an attacker-controlled host. On cloud-hosted instances, prompt injection can drive this to exfiltrate IAM credentials and instance metadata.
Mitigation
The source does not state a fix yet. Check the original advisory for updates.
Related items
- MediumCVE-2026-124028: mistral.rs delimiter injection allows attacker-chosen tool calls via quoted textSimilar attack · NVD/CVE Database
- InfoCVE-2026-123357: GROBID command execution through crafted PDF filename in Linux conversionSimilar attack · NVD/CVE Database
- MediumCVE-2026-123851: JetBrains Junie GitHub Action prompt injection bypass via HTML encodingSimilar attack · NVD/CVE Database
- MediumShai-Hulud Descendant Surfaces in Malicious Ruby Gem That Steals Credentials and Poisons AI ToolsSimilar attack · Socket Blog
- MediumCPython flaw exposes AI inference servers to sandbox escape attacksSimilar attack · CSO Online