PT-2026-50681 · Npm · Swagger-Typescript-Api
CVE-2026-54663
·
Published
2026-06-18
·
Updated
2026-07-29
CVSS v3.1
6.1
Medium
| Vector | AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
swagger-typescript-api versions prior to 13.12.2
Description
An issue exists where the tool fails to properly validate external reference URLs during the generation of API clients from OpenAPI specifications. Specifically, the
warmUpRemoteSchemasCache function and fetchRemoteSchemaDocument use the isHttpUrl function, which only checks if a URL starts with http or https. It does not implement private IP allowlists, DNS rebinding protection, redirect limits, or same-origin validation.This allows a malicious OpenAPI specification to force the generator process to issue HTTP GET requests to arbitrary hosts and paths reachable from the generator's network. This includes loopback addresses like
127.0.0.1, RFC-1918 private address ranges, and cloud instance-metadata endpoints such as 169.254.169.254. This can be exploited when a developer or CI pipeline runs the generator against an attacker-controlled specification.Recommendations
Update swagger-typescript-api to version 13.12.2 or later.
Exploit
Fix
SSRF
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Swagger-Typescript-Api