AIKIDO-2025-10381
@apidevtools/json-schema-ref-parser is vulnerable to Server-Side Request Forgery
20
Low Risk
This Affects:
@apidevtools/json-schema-ref-parserTL;DR
Affected versions of this package are vulnerable to Server-Side Request Forgery (SSRF) due to the default schema resolver can potentially fetch requests from tainted urls without further validation. An attacker could exploit this by submitting a malicious schema with $ref pointing to localhost, internal APIs, or cloud metadata services, potentially bypassing network controls and accessing sensitive data.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
@apidevtools/json-schema-ref-parser is vulnerable to Server-Side Request Forgery in versions 11.4.1 - 13.0.5.
How to fix this
Upgrade the @apidevtools/json-schema-ref-parser library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.