The typescript-utcp package's @utcp/http component before version 1.1.2 is vulnerable to a blind SSRF due to inconsistent validation between manual discovery and tool invocation. Specifically, registerManual() validates discovery URLs against an HTTPS and loopback allowlist, but callTool() reuses the resolved toolCallTemplate.url without revalidation. The OpenApiConverter trusts the servers[0].url field from an attacker-controlled OpenAPI spec, allowing an attacker to specify internal IP addresses such as 127.0.0.1 or 169.254.169.254. This causes the server to issue requests to internal services, potentially exposing sensitive internal resources. The vulnerability is addressed in version 1.1.2.

An attacker who can host a malicious OpenAPI specification on a legitimate HTTPS endpoint can exploit this vulnerability to cause the server to send requests to internal or loopback addresses. This may lead to unauthorized access or information disclosure from internal services accessible only from the server. The impact is limited to confidentiality and integrity with no direct availability impact. The CVSS score of 4.7 reflects a medium severity level with network attack vector, high attack complexity, no privileges required, and user interaction required.

Upgrade to typescript-utcp version 1.1.2 or later, where this SSRF vulnerability has been fixed. There is no official vendor advisory specifying alternative mitigations. Patch status is not explicitly confirmed beyond the fix in version 1.1.2, so users should verify the upgrade. No other mitigations are indicated by the vendor advisory.