« Volver al listado

CVE-2026-45366

Estado: AplazadaMedia (4.7)—

typescript-utcp is a typescript implementation of UTCP. Prior to 1.1.2, the @utcp/http package is vulnerable to a blind Server-Side Request Forgery (SSRF) caused by a trust-boundary inconsistency between manual discovery and tool invocation. registerManual() validates the discovery URL against an HTTPS / loopback allowlist, but callTool() reuses the resolved toolCallTemplate.url directly without revalidating, and the OpenApiConverter blindly trusts whatever servers[0].url an attacker-hosted spec declares.

Leer descripción completaMostrar menos

An attacker who hosts a malicious OpenAPI spec on a legitimate HTTPS endpoint can declare e.g. servers: [{ url: "http://127.0.0.1:9090" }] or servers: [{ url: "http://169.254.169.254" }]; the converter then produces tools whose URL points at internal services on the agent host. This vulnerability is fixed in 1.1.2.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Typescript — UtcpAIUtcp — HttpAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-45366",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-45366",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-05-29T13:56:02.351079Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 4.7,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 1.6
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "universal-tool-calling-protocol",
          "product": "typescript-utcp",
          "versions": [
            {
              "status": "affected",
              "version": "< 1.1.2"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-05-28T22:17:00.773",
  "references": [
    {
      "url": "https://github.com/universal-tool-calling-protocol/typescript-utcp/security/advisories/GHSA-r8j5-8747-88cm",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "typescript-utcp is a typescript implementation of UTCP. Prior to 1.1.2, the @utcp/http package is vulnerable to a blind Server-Side Request Forgery (SSRF) caused by a trust-boundary inconsistency between manual discovery and tool invocation. registerManual() validates the discovery URL against an HTTPS / loopback allowlist, but callTool() reuses the resolved toolCallTemplate.url directly without revalidating, and the OpenApiConverter blindly trusts whatever servers[0].url an attacker-hosted spec declares. An attacker who hosts a malicious OpenAPI spec on a legitimate HTTPS endpoint can declare e.g. servers: [{ url: \"http://127.0.0.1:9090\" }] or servers: [{ url: \"http://169.254.169.254\" }]; the converter then produces tools whose URL points at internal services on the agent host. This vulnerability is fixed in 1.1.2."
    },
    {
      "lang": "es",
      "value": "typescript-utcp es una implementación de UTCP en typescript. Antes de la versión 1.1.2, el paquete @utcp/http es vulnerable a una falsificación de petición del lado del servidor (SSRF) ciega causada por una inconsistencia en el límite de confianza entre el descubrimiento manual y la invocación de herramientas. registerManual() valida la URL de descubrimiento contra una lista de permitidos de HTTPS / loopback, pero callTool() reutiliza directamente la URL resuelta de toolCallTemplate.url sin revalidar, y el OpenApiConverter confía ciegamente en cualquier servers[0].url que declare una especificación alojada por un atacante. Un atacante que aloja una especificación OpenAPI maliciosa en un punto final HTTPS legítimo puede declarar, por ejemplo, servers: [{ url: 'http://127.0.0.1:9090' }] o servers: [{ url: 'http://169.254.169.254' }]; el conversor entonces produce herramientas cuya URL apunta a servicios internos en el host del agente. Esta vulnerabilidad se corrigió en la versión 1.1.2."
    }
  ],
  "lastModified": "2026-07-21T10:10:00.103",
  "sourceIdentifier": "security-advisories@github.com"
}