THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-x36r-4347-pm5x (medium) — swagger-typescript-api vulnerable to Server-Side Request Forgery via spec `$ref`

[GHSA] GHSA-x36r-4347-pm5x (medium) — swagger-typescript-api vulnerable to Server-Side Request Forgery via spec `$ref`

highgithub_advisoriesPublished 2026-07-29

GHSA-x36r-4347-pm5x Severity: medium CVE: CVE-2026-54663

swagger-typescript-api vulnerable to Server-Side Request Forgery via spec `$ref`

### Summary

`swagger-typescript-api` walks every `$ref` value in the input OpenAPI spec and, for any `$ref` whose target is an `http(s)://` URL, issues an HTTP GET to that URL during generation (`warmUpRemoteSchemasCache`). The only URL filter is a regex that

Indicators of compromise

CVE-2026-54663cve
http://127.0.0.1:url
https://attacker.example/openapi.json`url
http://169.254.169.254/...`url
127.0.0.0/8cidr
10.0.0.0/8cidr
172.16.0.0/12cidr
192.168.0.0/16cidr
169.254.0.0/16cidr
0.0.0.0/8cidr

Original source: https://github.com/advisories/GHSA-x36r-4347-pm5x