CVE-2026-54663

Deferred Deferred - Pending Action

Remote Schema Fetching in swagger-typescript-api Allows SSRF

Publication date: 2026-07-29

Last updated on: 2026-07-29

Assigner: GitHub, Inc.

Description

swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/resolved-swagger-schema.ts warmUpRemoteSchemasCache resolves external $ref URLs and fetchRemoteSchemaDocument uses isHttpUrl to fetch any http or https target without private IP, redirect, DNS rebinding, or same-origin validation, allowing an attacker-controlled OpenAPI spec to make the generator issue requests to internal or link-local services. This issue is fixed in version 13.12.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-29

Last Modified

2026-07-29

Generated

2026-08-19

AI Q&A

2026-07-30

EPSS Evaluated

2026-08-18

NVD

CVE-2026-54663

Affected Vendors & Products

Vendor	Product	Version / Range
swagger_typescript_api	swagger_typescript_api	13.12.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
CWE-20	The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
CWE-441	The product receives a request, message, or directive from an upstream component, but the product does not sufficiently preserve the original source of the request before forwarding the request to an external actor that is outside of the product's control sphere. This causes the product to appear to be the source of the request, leading it to act as a proxy or other intermediary between the upstream component and the external actor.

Attack-Flow Graph

Executive Summary

The vulnerability in swagger-typescript-api before version 13.12.2 allows an attacker to craft an OpenAPI specification that forces the tool to make HTTP requests to internal or restricted network services. This occurs because the tool fetches external $ref URLs without validating the target, enabling requests to private IPs or link-local addresses.

Detection Guidance

The vulnerability in swagger-typescript-api prior to 13.12.2 allows an attacker-controlled OpenAPI spec to make requests to internal or link-local services. To detect this, monitor network traffic for unexpected outbound HTTP/HTTPS requests from the swagger-typescript-api process. Check for connections to private IP ranges (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or link-local addresses (e.g., 169.254.0.0/16). Use tools like netstat, ss, or Wireshark to inspect active connections. Ensure the installed version is 13.12.2 or later.

Impact Analysis

An attacker could exploit this to probe internal network services, potentially exposing sensitive information or triggering unintended actions. This may lead to data leaks, service disruption, or unauthorized access if internal services are vulnerable.

Compliance Impact

This vulnerability could violate GDPR or HIPAA by enabling unauthorized network access or data exfiltration if internal services handle protected data. Organizations may face compliance penalties if such breaches occur due to inadequate network validation.

Mitigation Strategies

Update swagger-typescript-api to version 13.12.2 or later to address the vulnerability in schema resolution and remote fetching.

Hi! I’m here to help you understand CVE-2026-54663. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70