CodeWhale, a terminal coding agent, contains a server side request forgery vulnerability. The flaw allows an attacker to supply an IPv6 loopback address in the URL (http://[::1]) that bypasses the tool's defensive checks that normally block private IPv6 addresses. The attacker can force the application to send requests to local or internal services, potentially exposing sensitive data or enabling privilege escalation. This is a classic SSRF problem classified as CWE-918.

The vulnerability affects all releases of CodeWhale prior to version 0.8.26, including the DeepSeek‑based terminal agent. The fix was introduced in the 0.8.26 release. Users running CodeWhale 0.8.25 or earlier are therefore exposed.

With a CVSS score of 7.4, this weakness poses a high impact outage or data disclosure risk. The EPSS is not available, and the vulnerability is not listed in CISA's KEV catalog, suggesting no widely known exploitation. The likely attack vector is remote: a malicious user or compromised input can supply the specially crafted IPv6 URL to the application, causing it to reach a local target. The vulnerability does not require privileged access to the host to trigger.