GHSA-7Q9C-HPX7-9CWM: GHSA-7Q9C-HPX7-9CWM: Unauthenticated Remote Shutdown in @typespec/spector Mock Server

#security #cve #cybersecurity #ghsa

GHSA-7Q9C-HPX7-9CWM: Unauthenticated Remote Shutdown in @typespec/spector Mock Server

Vulnerability ID: GHSA-7Q9C-HPX7-9CWM
CVSS Score: 7.5
Published: 2026-09-04

An unauthenticated remote shutdown vulnerability exists in the Microsoft TypeSpec Spector mock server. Due to missing authentication on critical administrative routes and binding to all network interfaces, any remote attacker can shut down the mock server.

TL;DR

Unauthenticated remote attackers can shut down the @typespec/spector mock server via a simple POST request due to missing authentication and wildcard host binding.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-306
Attack Vector: Network
CVSS v3.1: 7.5 (High)
Exploit Status: PoC Available
CWE Name: Missing Authentication for Critical Function
Affected Function: POST /.admin/stop
Impact: Denial of Service (DoS)

Affected Systems

TypeSpec Spector mock server
@typespec/spector NPM package
@typespec/spector: <= 0.1.0-alpha.26 (Fixed in: 0.1.0-alpha.27)

Code Analysis

Commit: 30d6f65

Fix: Restrict Spektor mock server to loopback host

Commit: 39f8f02

Merge branch release into main

Mitigation Strategies

Bind the server to 127.0.0.1 instead of 0.0.0.0.
Implement host-level firewall rules to restrict port access.
Upgrade @typespec/spector package to version 0.1.0-alpha.27 or higher.

Remediation Steps:

Identify any usages of @typespec/spector in development scripts or packages.
Update dependency version in package.json to at least '0.1.0-alpha.27'.
Verify that the server starts on '127.0.0.1' instead of binding to '0.0.0.0' or '::'.

References

Read the full report for GHSA-7Q9C-HPX7-9CWM on our website for more details including interactive diagrams and full exploit analysis.

DEV Community