YApi Abandoned Since 2022: Fork Yapix Exposes Forgable Project Tokens and Critical Sandbox Flaws

YApi, the popular self-hosted API management platform developed by YMFE (Qunar), has remained unmaintained since its last release, version 1.12, in November 2022. The tool provides interface documentation, a Mock.js-based mock server, test suites, Swagger and Postman import, and is used by backend, frontend, and QA teams. It has accumulated 27.7 thousand GitHub stars and its unofficial Docker image has been downloaded more than 600 thousand times, making it a de-facto standard in China.

The project now contains 1,629 open issues. Among them is a report describing remote code execution through mock scripts that received no response. Numerous users also report that the cross-request browser extension no longer functions. Security researcher Perruer decided to continue development under the name Yapix (Apache-2.0 license), preserving full compatibility with existing YApi 1.12 databases while fixing critical issues.

Broken components in 2026

Node.js 22 removed the crypto.createCipher function used by YApi to encrypt project tokens, breaking open API access, CI test automation, and IDE plugins. The frontend build relies on the long-abandoned ykit wrapper around webpack 1 and node-sass 4, which no longer install on modern Node. The client bundle is committed directly to the repository, preventing any UI modifications. Package locks reference dead Chinese npm mirrors that no longer serve packages. The cross-request browser extension was written for Manifest V2 and has been removed from the Chrome Web Store. Production dependencies contain 244 known vulnerabilities according to GitHub Advisory, including 50 critical ones in mongoose 5.7, vm2, and an outdated koa version.

Forgable project tokens

Project tokens are stored as random 20-character strings. Users receive an encrypted string in the format uid|project_token. The encryption key is taken from the passsalt field in config.json; when absent, the code falls back to the constant defaultSalt = 'abcde', which is published on GitHub. Because the key is public, any user with guest access can decrypt their own token, extract the project token, and forge a token containing another user’s uid. The server only verifies that decryption succeeds and then applies the permissions of the supplied uid. Yapix generates a 32-byte random secret on first start if none is configured, rejects legacy tokens by default, and logs any use of legacy tokens when the temporary “legacyTokens” flag is enabled.

Unsafe script execution and other fixes

Mock scripts, test assertions, and pre/post-request scripts were executed on the server using vm2 and the Node vm module, both of which are documented as unsafe. Yapix runs all scripts inside isolated-vm with a fresh isolate per execution, 64 MB memory limit, 3-second CPU time limit, and no access to require, filesystem, or network. Only JSON-serializable data is passed in and out. The Mongoose layer was updated from version 5 to 9, replacing removed methods and callbacks. All API parameters are now filtered to block MongoDB operators. Password storage was changed from salted SHA-1 to scrypt, and the first administrator password is now taken from an environment variable or generated once. LDAP authentication now properly escapes the login and rejects empty passwords.

The client was rebuilt with webpack 5, Babel 7, and dart-sass. A new Manifest V3 browser extension was written that registers content scripts only for user-approved origins. The single remaining vulnerability, prototype pollution in Mock.js 1.1.0, was mitigated by a thin wrapper that filters the “proto” key. Continuous integration verifies that an existing YApi 1.12 database continues to work after migration to Yapix on Node 24.