Junglewise Threat Intelligence

CVE-2026-54663: acacode swagger-typescript-api SSRF via remote schema resolution

CVE-2026-54663 · Severity: medium · CVSS 6.1 · Published 2026-07-29

Technologies: swagger-typescript-api (npm). Vendors: npm.

Executive brief

swagger-typescript-api is a tool used by developers to automatically generate TypeScript code for interacting with web services. A security flaw allows a malicious API specification to force the code generator to make unauthorized requests to internal network services, such as private databases or cloud metadata services. This could lead to the exposure of sensitive internal information or credentials if a developer or automated system processes a compromised API definition.

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in swagger-typescript-api prior to version 13.12.2. The 'warmUpRemoteSchemasCache' function in 'src/resolved-swagger-schema.ts' resolves external '$ref' URLs using 'fetchRemoteSchemaDocument' without validating the target destination. An attacker can provide a malicious OpenAPI specification that forces the generator to issue HTTP requests to loopback (127.0.0.1), RFC-1918 private networks, or cloud metadata endpoints (169.254.169.254). The vulnerability lacks DNS rebinding protection and redirect validation. Version 13.12.2 introduces a defense-in-depth policy that blocks private/loopback addresses and enforces same-origin checks for remote schema resolution.

Affected products

  • acacode swagger-typescript-api < 13.12.2

Timeline

  • 2026-06-08: patched: Fixed in version 13.12.2 via PR #1779
  • 2026-07-29: advisory: NVD publication date

References

Related threats