high · 7.5Sep 4, 2026

@typespec/spector Unauthenticated Remote Shutdown via POST /.admin/stop

Pranav Khune
Penetration Testing Team Lead, SecureLayer7

Any network-reachable attacker can kill a running @typespec/spector mock server with a single unauthenticated HTTP POST, because the shutdown endpoint has no authentication, token check, or IP…

Package@typespec/spector
Ecosystemnpm
Affected<= 0.1.0-alpha.26
Fixed in0.1.0-alpha.27
@typespec/spector Unauthenticated Remote Shutdown via POST /.admin/stop

The problem

The POST /.admin/stop route in packages/spector/src/routes/admin.ts calls process.exit(0) with zero authentication guards. No Authorization header, API token, Origin check, or IP allowlist sits between the inbound request and the shutdown call.

The server binds to 0.0.0.0 by default (all interfaces) and offers no --host flag to restrict the bind address. Any host that can reach the port, including untrusted CI runners, shared cloud dev environments, or containers without network isolation, can terminate the process instantly.

Proof of concept

A working proof-of-concept for this issue in @typespec/spector, with the exact payload below.

bash
curl -i -X POST http://<server-host>:3000/.admin/stop

The root cause is CWE-306: the Express router registers the shutdown handler with no middleware before it. The vulnerable sink is router.post(AdminUrls.stop, (_req, res) => { ... process.exit(0); }) in admin.ts:7-12, where AdminUrls.stop resolves to /.admin/stop.

The patch (PR #11274, commits 30d6f659 and 39f8f023) adds authentication middleware or a secret-token check in front of this route, so unauthenticated requests are rejected before reaching the process.exit call. The fix landed in 0.1.0-alpha.27.

The fix

Upgrade @typespec/spector to 0.1.0-alpha.27 or later. Until you can upgrade, firewall the spector port to trusted hosts only, or run the server in a network-isolated environment. There is no config-level workaround in affected versions because the CLI exposes no --host bind flag.

Reporter not attributed.

References: [1][2][3][4][5][6]

Related research