Is CVE-2026-54663 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-54663 being exploited in the wild.

How severe is CVE-2026-54663?

Medium severity, with a CVSS score of 6.1, published 29 July 2026.

Which products and versions are affected?

swagger-typescript-api (npm) <= 13.12.1, SEMVER:introduced=0,fixed=13.12.2.

Is there a fix for CVE-2026-54663?

Yes. swagger-typescript-api (npm): upgrade to 13.12.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-54663 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-54663?

Check whether you run swagger-typescript-api (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54663: acacode swagger-typescript-api SSRF via remote schema resolution

Q: Is there a fix for CVE-2026-54663?

Yes. swagger-typescript-api (npm): upgrade to 13.12.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-54663 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-54663?

Check whether you run swagger-typescript-api (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54663 · Severity: medium · CVSS 6.1 · Published 2026-07-29

swagger-typescript-api is a tool used by developers to automatically generate TypeScript code for interacting with web services. A security flaw allows a malicious API specification to force the code generator to make unauthorized requests to internal network services, such as private databases or cloud metadata services. This could lead to the exposure of sensitive internal information or credentials if a developer or automated system processes a compromised API definition.

Technologies: swagger-typescript-api (npm). Vendors: npm.

Quick answers

Is CVE-2026-54663 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-54663 being exploited in the wild.
How severe is CVE-2026-54663?: Medium severity, with a CVSS score of 6.1, published 29 July 2026.
Which products and versions are affected?: swagger-typescript-api (npm) <= 13.12.1, SEMVER:introduced=0,fixed=13.12.2.
Is there a fix for CVE-2026-54663?: Yes. swagger-typescript-api (npm): upgrade to 13.12.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54663 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-54663?: Check whether you run swagger-typescript-api (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

swagger-typescript-api (npm): upgrade to 13.12.2 or later
```
npm install swagger-typescript-api@13.12.2
```

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in swagger-typescript-api prior to version 13.12.2. The 'warmUpRemoteSchemasCache' function in 'src/resolved-swagger-schema.ts' resolves external '$ref' URLs using 'fetchRemoteSchemaDocument' without validating the target destination. An attacker can provide a malicious OpenAPI specification that forces the generator to issue HTTP requests to loopback (127.0.0.1), RFC-1918 private networks, or cloud metadata endpoints (169.254.169.254). The vulnerability lacks DNS rebinding protection and redirect validation. Version 13.12.2 introduces a defense-in-depth policy that blocks private/loopback addresses and enforces same-origin checks for remote schema resolution.

Affected products

acacode swagger-typescript-api < 13.12.2

Identifiers

CVE-2026-54663
GHSA-x36r-4347-pm5x

Timeline

2026-06-08: patched: Fixed in version 13.12.2 via PR #1779
2026-07-29: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.