# CVE-2026-54663: acacode swagger-typescript-api SSRF via remote schema resolution

Source: https://junglewise.ai/threats/cve-2026-54663-acacode-swagger-typescript-api-ssrf-via-remote-schema-resolution  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-29. Updated: 2026-07-29  
License: CC BY 4.0 with a link back

CVE-2026-54663 · Severity: medium · CVSS 6.1 · Published 2026-07-29

swagger-typescript-api is a tool used by developers to automatically generate TypeScript code for interacting with web services. A security flaw allows a malicious API specification to force the code generator to make unauthorized requests to internal network services, such as private databases or cloud metadata services. This could lead to the exposure of sensitive internal information or credentials if a developer or automated system processes a compromised API definition.

Technologies: [swagger-typescript-api (npm)](https://junglewise.ai/threats/technologies/swagger-typescript-api). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-54663 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54663 being exploited in the wild.

**How severe is CVE-2026-54663?** Medium severity, with a CVSS score of 6.1, published 29 July 2026.

**Which products and versions are affected?** swagger-typescript-api (npm) <= 13.12.1, SEMVER:introduced=0,fixed=13.12.2.

**Is there a fix for CVE-2026-54663?** Yes. swagger-typescript-api (npm): upgrade to 13.12.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54663 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-54663?** Check whether you run swagger-typescript-api (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- swagger-typescript-api (npm): upgrade to 13.12.2 or later

  ```sh
  npm install swagger-typescript-api@13.12.2
  ```


## Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in swagger-typescript-api prior to version 13.12.2. The 'warmUpRemoteSchemasCache' function in 'src/resolved-swagger-schema.ts' resolves external '$ref' URLs using 'fetchRemoteSchemaDocument' without validating the target destination. An attacker can provide a malicious OpenAPI specification that forces the generator to issue HTTP requests to loopback (127.0.0.1), RFC-1918 private networks, or cloud metadata endpoints (169.254.169.254). The vulnerability lacks DNS rebinding protection and redirect validation. Version 13.12.2 introduces a defense-in-depth policy that blocks private/loopback addresses and enforces same-origin checks for remote schema resolution.

## Affected products

- acacode swagger-typescript-api < 13.12.2

## Identifiers

- CVE-2026-54663
- GHSA-x36r-4347-pm5x

## Timeline

- 2026-06-08: patched: Fixed in version 13.12.2 via PR #1779
- 2026-07-29: advisory: NVD publication date

## References

- [https://github.com/acacode/swagger-typescript-api/commit/306d59acb8ffbb00f953f807b97234b21f51d9de](https://github.com/acacode/swagger-typescript-api/commit/306d59acb8ffbb00f953f807b97234b21f51d9de)
- [https://github.com/acacode/swagger-typescript-api/pull/1779](https://github.com/acacode/swagger-typescript-api/pull/1779)
- [https://github.com/acacode/swagger-typescript-api/releases/tag/v13.12.2](https://github.com/acacode/swagger-typescript-api/releases/tag/v13.12.2)
- [https://github.com/acacode/swagger-typescript-api/security/advisories/GHSA-x36r-4347-pm5x](https://github.com/acacode/swagger-typescript-api/security/advisories/GHSA-x36r-4347-pm5x)

## Related threats

- [acacode swagger-typescript-api code injection in generated method bodies](https://junglewise.ai/threats/cve-2026-54666-acacode-swagger-typescript-api-code-injection-in-generated-method)
- [acacode swagger-typescript-api code injection in generated clients](https://junglewise.ai/threats/cve-2026-54664-acacode-swagger-typescript-api-code-injection-in-generated)
- [acacode swagger-typescript-api code injection in generated Fetch client](https://junglewise.ai/threats/cve-2026-54662-acacode-swagger-typescript-api-code-injection-in-generated-fetch)
- [acacode swagger-typescript-api code injection in axios-http-client](https://junglewise.ai/threats/cve-2026-54661-acacode-swagger-typescript-api-code-injection-in-axios-http)
- [acacode swagger-typescript-api credential exfiltration via remote $ref resolution](https://junglewise.ai/threats/cve-2026-54660-acacode-swagger-typescript-api-credential-exfiltration-via-remote)