This vulnerability in eyaushev swagger-testcase-mcp arises from improper handling in the loadSource function of the swagger-parser.ts file, enabling server-side request forgery. An attacker can remotely manipulate the function to cause the server to send crafted requests to arbitrary destinations. The project follows a rolling release strategy, preventing precise version identification of affected or fixed releases. No official remediation or patch has been released, and the vendor has not responded to the initial report. Exploit code has been publicly released, increasing the risk of exploitation.

Successful exploitation of this SSRF vulnerability allows an attacker to induce the server to make unauthorized requests to internal or external systems. This can lead to information disclosure, interaction with internal services, or other indirect impacts depending on the server's network environment. The vulnerability is remotely exploitable without user interaction and requires low attack complexity and privileges. The CVSS 4.0 score of 5.3 (medium) reflects limited but notable impact potential.

No official patch or remediation is currently available, and the vendor has not responded to the issue report. Users should monitor the project repository and advisories for updates. Until a fix is provided, consider implementing network-level controls to restrict outbound requests from the affected component to trusted destinations only. Review and restrict access to the vulnerable function if possible. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.