swagger-typescript-api vulnerable to authorization-token exfiltration via spec $ref

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS

7.4 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

EPSS

• CVE-2026-54660: 0.31% estimated exploitation activity in the next 30 days; percentile 23.82 (FIRST EPSS, 2026-11-03). This is a model estimate, not proof of exploitation or customer exposure.

As published by the source; long descriptions are shortened.

Summary When the developer supplies an --authorizationToken (commonly required to fetch a private spec behind authentication), swagger-typescript-api attaches that token to the Authorization header of every subsequent HTTP request it makes while resolving external $ref URLs in the spec — with no same-origin check, no host allowlist, and no scope-down for cross-origin requests. A malicious OpenAPI spec containing a $ref to an attacker-controlled URL therefore causes the developer's bearer token to be sent verbatim to that URL during code generation. The threat model is identical to the SSRF advisory filed alongside this one (companion finding), but with credential disclosure as the primary impact. The token is typically a high-value secret: a GitHub PAT, an OAuth bearer for the API the spec describes, an enterprise SSO token, an AWS-style API key, or similar. Disclosure to an attacker-controlled URL is one curl-equivalent away from full takeover of whatever scope the token grants.…

Published by the source

29 Jul 2026, 14:22 UTC

Last modified by the source

29 Jul 2026, 14:22 UTC

Source last checked

26 Oct 2026, 13:00 UTC

1. Revision 1 · created · 26 Oct 2026

   Published from ghsa record GHSA-h754-fxp7-88wx

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: CVE-2026-54660

Advisory: swagger-typescript-api vulnerable to authorization-token exfiltration via spec `$ref`
IDs: CVE-2026-54660, GHSA-h754-fxp7-88wx
Record: https://patchnext.com/advisories/cve-2026-54660 (revision 1, source checked 26 Oct 2026, 13:00 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: High (CVSS 7.4)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor fix available; fixed versions by package: swagger-typescript-api 13.12.2. A vendor fix does not mean a deployment is fixed.

## Affected components
- npm swagger-typescript-api: affected <= 13.12.1; fixed in 13.12.2

## Suggested inspection (read-only)
- `npm ls swagger-typescript-api --all`: lists every installed copy and version, including transitive ones. Run in the project root after `npm ci`.

## Supported action
Upgrade each affected component to a fixed version on its release line. For a transitive dependency, upgrade the parent package or add an override or constraint, then regenerate the lockfile. Redeploy every environment that ran an affected version.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on swagger-typescript-api.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://github.com/advisories/GHSA-h754-fxp7-88wx (GitHub-reviewed advisory GHSA-h754-fxp7-88wx lists affected ranges: npm swagger-typescript-api >=0 <=13.12.1)

Commands are suggestions: review each one before running it.