Spector Mock Server can be shut down remotely

Published September 4, 2026 GHSA-7q9c-hpx7-9cwm

A testing tool used by developers who build TypeSpec based APIs has a mock server that anyone on the network can shut down with a single web request. There is no password or check of any kind on the shutdown command.

Severity
HighCVSS 7.5
Fix
Fixed in 0.1.0-alpha.27Fix recorded on Sep 4, 2026
Affected versions
0.1.0-alpha.26 or older
Weakness
CWE-306
Affects
@typespec/spector

How it works

The mock server listens on all network interfaces by default and answers a specific stop web address with no login, token, or origin check, so any request to it shuts the process down.

What to do

Check your installed version with npm list @typespec/spector. Any version or below 0.1.0-alpha.26 is affected, especially if it runs on a shared network or CI runner reachable by others.

Run this in the application environment you want to check:

npm list @typespec/spector

Update to @typespec/spector version 0.1.0-alpha.27 or later, and until you update, avoid exposing the mock server's port beyond localhost or a trusted, isolated test network.

Technical details

Affected software: @typespec/spector

The Express router in packages/spector/src/routes/admin.ts registers a POST /.admin/stop route with zero authentication middleware, no Origin header check, and no IP allowlist. Since the CLI's serve command binds the app to all interfaces by default with no host option, any network client that can reach the chosen port (default 3000) can trigger process.exit(0), a clean unauthenticated denial of service. CVSS 3.1 score is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), reflecting full availability impact with no confidentiality or integrity loss. Fixed in 0.1.0-alpha.27.

References

View Original Source