Description
A security flaw has been discovered in eyaushev swagger-testcase-mcp 5babb27c951fb404bc2b25ec80593616e49054e5. This vulnerability affects the function loadSource of the file src/utils/swagger-parser.ts of the component fetch_swagger. Performing a manipulation results in server-side request forgery. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.
Published: 2026-08-14
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is a server‑side request forgery in the loadSource function of swagger-parser.ts within the fetch_swagger component. An attacker can remotely trigger the component to request arbitrary URLs, potentially accessing internal resources or exfiltrating data. The flaw is classified as CWE‑918 and carries a CVSS score of 5.3, indicating moderate severity.

Affected Systems

This issue affects the eyaushev swagger‑testcase‑mcp project. Versions of the project that contain the commit 5babb27c951fb404bc2b25ec80593616e49054e5 are vulnerable, and because the project follows a rolling release model no specific version numbers can be listed. Any deployment that includes this module without a subsequent fix is at risk.

Risk and Exploitability

The flaw can be exploited remotely and the exploit code has already been released to the public. While the EPSS score is not available, the lack of a KEV listing and the CVSS of 5.3 suggest moderate risk. Attackers can leverage the server‑side request forgery to reach internal services and potentially compromise confidentiality or integrity of data accessed through the vulnerable component.

Generated by OpenCVE AI on August 14, 2026 at 02:39 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the swagger‑testcase‑mcp package to a version that contains the fix once it becomes available
  • If an immediate update is not possible, limit or block outbound network traffic initiated by the loadSource function to trusted hosts only
  • Validate or sanitize any external URLs before they are supplied to loadSource to prevent unintended requests

Generated by OpenCVE AI on August 14, 2026 at 02:39 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 14 Aug 2026 01:15:00 +0000

Type Values Removed Values Added
Description A security flaw has been discovered in eyaushev swagger-testcase-mcp 5babb27c951fb404bc2b25ec80593616e49054e5. This vulnerability affects the function loadSource of the file src/utils/swagger-parser.ts of the component fetch_swagger. Performing a manipulation results in server-side request forgery. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.
Title eyaushev swagger-testcase-mcp fetch_swagger swagger-parser.ts loadSource server-side request forgery
First Time appeared Eyaushev
Eyaushev swagger-testcase-mcp
Weaknesses CWE-918
CPEs cpe:2.3:a:eyaushev:swagger-testcase-mcp:*:*:*:*:*:*:*:*
Vendors & Products Eyaushev
Eyaushev swagger-testcase-mcp
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Eyaushev Swagger-testcase-mcp
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-18T13:39:32.454Z

Reserved: 2026-08-13T16:56:32.206Z

Link: CVE-2026-19765

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-08-14T01:18:57.637

Modified: 2026-08-18T14:16:57.390

Link: CVE-2026-19765

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-14T09:29:57Z

Weaknesses
  • CWE-918

    Server-Side Request Forgery (SSRF)