CodeWhale versions prior to 0.8.22 contain an SSRF vulnerability due to insufficient validation of redirected URLs in the fetch_url tool. While the initial URL's IP address is checked against a restricted IP blocklist to prevent SSRF attacks targeting internal services, the HTTP client (reqwest) automatically follows up to 5 redirects without re-validating the redirected URLs against the same blocklist. This allows an attacker to potentially bypass SSRF protections by leveraging redirects to access internal or restricted network resources. The vulnerability is identified as CWE-918 and has a CVSS 3.1 score of 7.4, indicating high severity. The issue is resolved in CodeWhale version 0.8.22.

Successful exploitation of this SSRF vulnerability could allow an attacker to make unauthorized requests from the vulnerable server to internal services that are normally inaccessible externally, such as cloud metadata endpoints, localhost, or private network resources. The CVSS vector indicates the attack can be performed remotely without privileges and requires user interaction, with high confidentiality impact but no impact on integrity or availability. No known exploits in the wild have been reported.

Users should upgrade CodeWhale to version 0.8.22 or later, where this SSRF vulnerability is fixed by adding validation of redirect targets against the restricted IP blocklist. Since the vendor advisory is not explicitly provided, patch status is inferred from the version information. Until upgrading, users should avoid using the vulnerable fetch_url tool or restrict its usage to trusted URLs. Monitor vendor advisories for official patch releases or additional mitigation guidance.