CodeWhale before version 0.8.64 contains an SSRF bypass flaw caused by DNS pinning logic that allows a time‑of‑check/time‑of‑use (TOCTOU) attack. By manipulating DNS responses, an attacker can cause the initial DNS check to fail and a subsequent request to resolve to an internal IP address, thereby violating SSRF mitigations and potentially accessing internal network resources. This flaw is a classic server‑side request forgery vulnerability identified with CWE‑918 and can result in confidential data exposure, lateral movement, and compromise of internal services.

The vulnerability affects the Hmbown CodeWhale platform on all releases prior to version 0.8.64. No other vendors or products are listed in the CVE data.

The CVSS score of 9.2 indicates a high severity risk, and the EPSS score is not available. The vulnerability is not yet listed in the CISA KEV catalog. Exploitation requires control over DNS responses for a domain used by the application, which is typically achievable for attackers who can host non‑trusted DNS servers or compromise existing DNS infrastructure. Once executed, the attacker can force the application to resolve internal IP addresses and bypass SSRF controls, allowing potential read, write, or execution operations against internal services.