The weekend published nothing: no reviewed advisory carries a September 5 or 6 date, so this is Friday's batch, caught up. codewhale — a terminal coding agent built on Anthropic's Claude Agent SDK — collected nine advisories in a single day, and five of them are tools that were documented to ask before acting and did not ask. vLLM took four more CVEs, all fixed in a version below the floor this digest has been naming since Monday. If you run a coding agent against a repo you did not write, codewhale is the one to read.

Worth your morning

codewhale — the approval prompt that doesn't prompt. Nine advisories, all published September 4, all fixed in 0.8.64. The critical is CVE-2026-75856 (9.2), a time-of-check-to-time-of-use gap in the DNS pinning that backs the agent's SSRF protection: the check and the fetch resolve separately, so the guard passes on one answer and the request goes out on another. The vector is AV:N/AC:L/PR:N/UI:N with a scope change, and the advisory names private services, private networks and cloud credentials as what sits behind it.

The other eight are the interesting part, because they share one shape. rlm_eval runs model-supplied Python without the approval step (CVE-2026-75858, 8.5). exec_shell_interact passes model-controlled input to a live shell without prompting. git_blame and git_show reach arbitrary file read and arbitrary file write through argument injection, both without approval (CVE-2026-75912, 8.3). A cloned repo's project config can flip allow_shell on by itself (CVE-2026-75911, 8.5) or pull arbitrary files into the system prompt. js_execution hands the parent environment to the model. image_analyze follows symlinks out of the workspace.

For an agent, the approval gate is the product. Five separate tools reached around it, and the two config-override issues mean the repository you clone gets to decide what the gate is set to before you ever see a prompt. Take 0.8.64 as the floor; 0.9.12 is current and is what you want. If you ran any 0.8.4x against a repository you did not write yourself, treat the credentials on that machine as having been readable and rotate them.

The abandoned name has no fix. codewhale used to ship as deepseek-tui, and the advisories cover both names. The npm package is patched at 0.8.41 and current at 0.8.47. The cargo crate is not patched at all — every one of the nine advisories lists deepseek-tui on cargo as affected through 0.8.41 with no fixed version, because the maintainer moved to the new name and left the old crate where it was. There is no upgrade path on that crate; the action is to move to codewhale or remove it. A rename is a fine way to run a project and a poor way to retire a security boundary — anyone who installed the old crate and never followed the rename is holding nine open advisories with no version to move to.

vLLM — four CVEs, and you are probably already done. CVE-2026-73557 (6.3) is a race in the prompt-embedding path that can undo the CVE-2025-62164 remediation under concurrency, and it applies only if you turned on --enable-prompt-embeds, which is off by default. CVE-2026-73556 (5.3) is the ReDoS sibling that the earlier structured-output fixes missed, and it reaches only the lm-format-enforcer backend, which is opt-in. CVE-2026-73555 (5.3) leaks OS username, home directory and virtualenv paths through unsanitised validation errors on every JSON endpoint. CVE-2026-71486 (4.3) is unbounded resource use on the derender endpoints.

All four are fixed in 0.26.0, two minors below the 0.28.0 this digest has been telling you to take since Monday. Anyone who acted on last week's vLLM batch closed these before they were published. The one to note anyway is 73555: it needs no flag and no configuration, so if you are pinned below 0.26.0 for a compatibility reason, your inference endpoint has been handing out its filesystem layout to anyone who sends it a malformed request.

@typespec/spector — a mock server with an unauthenticated stop button. GHSA-7q9c-hpx7-9cwm (7.5, no CVE, CWE-306) affects everything through 0.1.0-alpha.26 and is fixed in 0.1.0-alpha.27. The /.admin/stop endpoint has no authentication, so one request from anywhere on the network ends the process. It binds to 0.0.0.0 with no flag to change that, which is the reason a test-harness DoS is a high rather than a shrug. Availability-only, no data impact, and it belongs to API spec test suites rather than production — but if your CI runners share a network segment with anything untrusted, a build that fails for no visible reason is now a thing that can happen to you.

Standing items

Milvus, day twenty-six. CVE-2026-69111 (8.7) is unchanged. PR #49847 is still open, still one approval short of two, Code-Check still failing, no activity since August 14. Port 9091 stays firewalled.

Ollama remains clean. Still no published advisories, ever.

Carried unchanged from September 4: unstructured wants 0.24.0 or later, NLTK wants 3.10.3 plus NLTK_PATHSEC_ENFORCE=1 with CVE-2026-81726 still open on current, MLflow wants 3.15.0, omnigent wants 0.3.0, orval wants 8.22.0, claude-code-templates wants 1.29.4, @toon-format/toon wants 2.3.1, @openclaw/feishu wants 2026.6.9, pnpm wants 10.34.5 / 11.11.0, nanoid wants 3.3.12 / 5.1.11, fast-uri wants 2.4.5 / 3.1.6 / 4.1.3, @faker-js/faker wants 10.5.0, banks wants 2.4.5, Chainlit wants 2.12.0 or MCP off, PraisonAI wants 4.6.58 with an audit after it, pantheon-agents wants 0.6.4 plus credential rotation, RestrictedPython wants 8.3, the npm MariaDB connector wants 3.2.4 / 3.3.3 / 3.4.6 / 3.5.3, engine.io wants 6.6.7, 9router is fixed for two of eleven at 0.5.2, vm2 wants 3.11.6, xinference wants 2.7.0, jsonata wants 1.8.8 / 2.2.1 with Node-RED still pinned below the floor, MONAI wants 1.6.0, hydra-core wants 1.3.4, Flowise is archived at 3.1.4 with four permanent criticals, mcp-florence2 is vendor-declined, the unfixed MCP servers from August 17 are unchanged, AgenticSeek needs its token set plus a loopback bind, Langflow wants 1.11.3, Traefik wants 2.11.52 / 3.6.23 / 3.7.7, go-git wants 5.19.2 or 6.0.0-alpha.5, Open WebUI wants 0.11.0, n8n wants 1.123.69 / 2.33.4 / 2.34.1, SSH.NET wants the 2026.0.0 major, .NET wants 8.0.30 / 9.0.19 / 10.0.11.

Feed notes. No reviewed advisory anywhere carries a September 5 or 6 publication date — the review queue paused for the weekend. NuGet is unchanged since the September 2 Magick.NET memory leak; the August 11 .NET batch still stands and the next Microsoft cycle is Tuesday the 8th. Nothing new from Angular or PrimeNG, and PrimeNG remains security-fix-only under PrimeUI. Nothing from LangChain, LlamaIndex, Haystack, Triton, Qdrant, Chroma, Weaviate, or the OpenAI, Anthropic and Google status pages.

Filtered out and why: @simplewebauthn/server is a low against attestation trust-anchor checking. Material for MkDocs, Scrapy, Mistune, Tornado and pypdf ×2 are real but sit on neither stack. The Go criticals — OpenChoreo and eight against SiYuan's kernel — and the two Rust SurrealDB advisories are outside scope entirely.