CVE-2026-54663 in swagger-typescript-api
Summary
by MITRE • 07/29/2026
swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/resolved-swagger-schema.ts warmUpRemoteSchemasCache resolves external $ref URLs and fetchRemoteSchemaDocument uses isHttpUrl to fetch any http or https target without private IP, redirect, DNS rebinding, or same-origin validation, allowing an attacker-controlled OpenAPI spec to make the generator issue requests to internal or link-local services. This issue is fixed in version 13.12.2.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/29/2026
The vulnerability in swagger-typescript-api affects versions prior to 13.12.2 where the library processes external $ref URLs without adequate security validation mechanisms. The core flaw exists in the src/resolved-swagger-schema.ts file within the warmUpRemoteSchemasCache function and fetchRemoteSchemaDocument method which handle remote schema resolution. When processing OpenAPI specifications, the library uses isHttpUrl to identify HTTP or HTTPS targets for fetching external references but fails to implement proper validation checks that would prevent access to internal network resources.
This security weakness stems from insufficient input sanitization and validation of remote reference URLs. The implementation blindly follows any HTTP or HTTPS URL without performing checks against private IP address ranges, link-local addresses, or other restricted network destinations. Attackers can craft malicious OpenAPI specifications that contain $ref entries pointing to internal services such as localhost, 169.254.x.x ranges, or other private network addresses. The vulnerability represents a classic server-side request forgery (SSRF) attack vector where the library acts as an unwitting proxy for external attackers.
The operational impact of this vulnerability is significant as it allows remote code execution or information disclosure scenarios. An attacker who can influence the OpenAPI specification used by swagger-typescript-api could potentially access internal services that are normally protected by network segmentation. This includes accessing internal APIs, databases, or other sensitive systems that should not be directly reachable from the internet. The attack surface expands to any service running on the same host or accessible through local network interfaces. The vulnerability is particularly dangerous in environments where the API generator is used with untrusted OpenAPI specifications.
The technical implementation fails to adhere to security best practices outlined in CWE-918, which addresses server-side request forgery vulnerabilities. This flaw also aligns with ATT&CK technique T1071.004 for application layer protocol usage and T1566 for malicious command execution through API endpoints. The library should implement comprehensive URL validation that filters out private IP ranges, validates DNS resolution, checks for redirect loops, and enforces same-origin policies. Proper mitigation requires validating all external references against a whitelist of allowed domains or implementing strict network access controls that prevent connections to internal services.
The fix implemented in version 13.12.2 addresses this vulnerability by introducing proper validation mechanisms for remote URL resolution. The updated implementation likely includes checks for private IP ranges, link-local addresses, and other restricted network destinations. Security practitioners should immediately upgrade to version 13.12.2 or later to remediate this issue. Organizations using swagger-typescript-api with untrusted OpenAPI specifications should also consider implementing additional security controls such as network segmentation, proxy configurations, or content filtering to prevent potential exploitation of similar vulnerabilities in other tools within their API development pipeline.