CVE-2026-54663

The CVSS 6.1 score for this vulnerability in swagger-typescript-api is misleading. This isn't a typical SSRF where an attacker needs direct network access to your services. Instead, the attacker supplies a malicious OpenAPI specification to your build pipeline, and the tool—designed to dereference external $ref references—silently proxies requests to whatever internal infrastructure your build environment can reach. The critical distinction: your CI/CD runner, developer workstation, or build container has credentials, tokens, and network privileges that an external attacker could never obtain directly. The SSRF is the reconnaissance phase, not the end goal. Through the build proxy, an attacker can reach cloud metadata endpoints (AWS IMDS, GCP metadata), internal APIs, orchestration platforms, and private registries. Version 13.12.2 contains the fix. You need to verify three things immediately: first, confirm you're on 13.12.2 or later; second, audit whether any cached artifacts from prior builds contain entries pointing to internal services—the 'warmUpRemoteSchemasCache' function persists these requests across build invocations, meaning even a patched version could replay compromised cache entries; third, determine whether the fix addresses DNS rebinding or only blocks static private IP ranges, as this leaves a residual vector if the validation can be circumvented via DNS. The broader risk is architectural. A code generator processing untrusted specs now has network reach into your infrastructure with your build credentials. Review whether third-party or community OpenAPI specs are being processed in sensitive environments, and treat untrusted OpenAPI specifications as hostile network payloads with the same rigor you'd apply to arbitrary code execution.

Reviewed through automated stages and approved by a human before publication.