typescript-utcp: SSRF via attacker-controlled OpenAPI servers[0].url in HTTP communication protocol

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-45366 · CVE overview and exploitation status

EUVD-2026-33053

GHSA-r8j5-8747-88cm

cve-program · CVE-2026-45366

• https://github.com/universal-tool-calling-protocol/typescript-utcp/security/advisories/GHSA-r8j5-8747-88cm

euvd · EUVD-2026-33053

• https://github.com/universal-tool-calling-protocol/typescript-utcp/security/advisories/GHSA-r8j5-8747-88cm

nvd · CVE-2026-45366

• https://github.com/universal-tool-calling-protocol/typescript-utcp/security/advisories/GHSA-r8j5-8747-88cm

osv · GHSA-r8j5-8747-88cm

• https://github.com/universal-tool-calling-protocol/typescript-utcp/security/advisories/GHSA-r8j5-8747-88cm
• https://nvd.nist.gov/vuln/detail/CVE-2026-45366
• https://github.com/universal-tool-calling-protocol/python-utcp/issues/83
• https://github.com/universal-tool-calling-protocol/typescript-utcp

No related changes are available here.