swagger-typescript-api constructs client code for Fetch or Axios from OpenAPI documents. In versions earlier than 13.12.2 the resolver for external $ref entries downloads referenced schemas without verifying that the URLs refer to safe, publicly reachable hosts. This constitutes a CWE‑20 (Improper Input Validation) weakness and a CWE‑441 (Redirection Control) flaw. An attacker can supply a malicious OpenAPI specification that points a $ref to an internal or link‑local address, causing the generator to issue HTTP or HTTPS requests from the build machine. This Server‑Side Request Forgery is an instance of CWE‑918 and can lead to information disclosure or interaction with internal services that should not be exposed.

The affected package is acacode swagger-typescript-api. Any project that includes a version earlier than 13.12.2 and uses the schema resolution logic is vulnerable. The fix is implemented in release 13.12.2 and later.

The CVSS score of 6.1 indicates moderate severity. The EPSS score is below 1 %, suggesting that the chance of automated exploitation is low at present. The vulnerability is not listed in the CISA KEV catalog. The likely attack occurs when a developer or automated build system imports an attacker‑controlled OpenAPI file into the swagger-typescript-api generator, forcing outbound requests from the build host to arbitrary internal services.