p PatchFirst

PatchFirst · Latest vulnerabilities

@typespec/spector vulnerabilities

Vulnerabilities published for @typespec/spector in the last 30 days: 0. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerability: 1

  1. GHSA-7q9c-hpx7-9cwm

    High · CVSS 7.5Fix available

    TypeSpec: Unauthenticated Remote Shutdown of Spector Mock Server via POST /.admin/stop

    ### Summary `@typespec/spector` registers a `POST /.admin/stop` HTTP route with no authentication, authorization token, Origin check, or IP-source restriction. Any network-reachable client can send a single unauthenticated POST request to terminate the mock server process. Because the server binds to `0.0.0.0` by default (all interfaces), this endpoint is exposed to any host that can reach the server's port—not just localhost—making a complete denial-of-service trivially achievable with one HTTP request. Severity is **High (CVSS 7.5)**. ### Details The vulnerability originates in `packages/spector/src/routes/admin.ts` at line 7, where an E

    @typespec/spectorNode.js
    • Update to 0.1.0-alpha.27
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →