AIKIDO-2026-11122

TL;DR

swagger-typescript-api issues HTTP requests to every $ref URL found in an OpenAPI specification during code generation without validating the target. A malicious spec can point $ref at internal hosts, loopback, RFC-1918 ranges, or the cloud instance-metadata endpoint, forcing the generator process to make attacker-directed requests. Missing DNS-rebinding protection, private-IP filtering, and redirect re-validation widen the reachable surface. The fix blocks private, loopback, and link-local targets, restricts cross-origin fetches to public hosts, and re-validates each redirect hop.