What is CVE-2026-54662?
CVE-2026-54662 is a Server-Side Request Forgery (SSRF) vulnerability in swagger-typescript-api, where the `servers[0].url` from an OpenAPI specification is directly copied to `apiConfig.baseUrl` before version 13.12.2, allowing attackers to specify a malicious URL and gain unauthorized access to internal network resources. Users should immediately upgrade to version 13.12.2 or later to mitigate this issue.
Azərbaycanca: CVE-2026-54662, swagger-typescript-api alətində aşkar edilmiş Server-Side Request Forgery (SSRF) boşluğudur. 13.12.2 versiyasından əvvəl, OpenAPI spesifikasiyasından `servers[0].url` dəyəri birbaşa `apiConfig.baseUrl`-ə kopyalanır ki, bu da təcavüzkarın zərərli `url` təqdim edərək daxili şəbəkə resurslarına icazəsiz sorğular göndərməsinə imkan verir. Təhlükəsizlik üçün kitabxananı dərhal 13.12.2 və ya daha yuxarı versiyaya yeniləmək tövsiyə olunur.
Related CVEs
link basis: same weakness class CWE-918
FAQ2
What product is affected by CVE-2026-54662 and what is the root cause of the vulnerability?
CVE-2026-54662 is a Server-Side Request Forgery (SSRF) vulnerability affecting the swagger-typescript-api tool. The root cause is that the `servers[0].url` from the OpenAPI specification is directly copied to `apiConfig.baseUrl`.
Which version should be upgraded to in order to fix CVE-2026-54662?
To fix this vulnerability, users should immediately upgrade the swagger-typescript-api library to version 13.12.2 or later.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.