Server-side Request Forgery (SSRF)

Overview linuxfabrik-lib is a Python libraries used in various Linuxfabrik projects, including the 'Linuxfabrik Monitoring Plugins' project. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the fetch function when credential headers are forwarded across a...

CVE-2026-54885 Server-side request forgery in Boruta OAuth request_uri and OpenID jwks_uri fetching

Server-Side Request Forgery vulnerability in malach-it Boruta allows an unauthenticated remote attacker to cause the OAuth/OpenID authorization server to issue outbound HTTP requests to attacker-chosen URIs, including internal services and cloud metadata endpoints. Three code paths fetch remote...

CVE-2026-67435 linuxfabrik-lib: fetch() forwards credential headers across a cross-origin redirect

linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integrations. Prior to version 6.0.0, lib.url.fetch followed cross-origin redirects while forwarding caller-supplied credential headers other than Authorization and Cookie, allowing a malicious...

CVE-2026-67435 linuxfabrik-lib: fetch() forwards credential headers across a cross-origin redirect

linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integrations. Prior to version 6.0.0, lib.url.fetch followed cross-origin redirects while forwarding caller-supplied credential headers other than Authorization and Cookie, allowing a malicious...

CVE-2026-67435

The issue in linuxfabrik-lib affects the Python module lib.url.fetch() in versions before 6.0.0. It may follow cross-origin redirects while forwarding caller-supplied credential headers other than Authorization and Cookie, enabling a malicious redirect-capable server to receive headers such as X-...

CVE-2026-67435 linuxfabrik-lib: fetch() forwards credential headers across a cross-origin redirect

linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integrations. Prior to version 6.0.0, lib.url.fetch followed cross-origin redirects while forwarding caller-supplied credential headers other than Authorization and Cookie, allowing a malicious...

CVE-2026-54660

swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/resolved-swagger-schema.ts getRemoteRequestHeaders forwards --authorizationToken to every URL fetched by fetchRemoteSchemaDocument while warmUpRemoteSchemasCache resolves external $r...

CVE-2026-54662

swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/code-gen-process.ts createApiConfig copies servers0.url into apiConfig.baseUrl, and templates/base/http-clients/fetch-http-client.ejs interpolates apiConfig.baseUrl into the generate...

GHSA-X36R-4347-PM5X swagger-typescript-api vulnerable to Server-Side Request Forgery via spec `$ref`

Summary swagger-typescript-api walks every $ref value in the input OpenAPI spec and, for any $ref whose target is an https:// URL, issues an HTTP GET to that URL during generation warmUpRemoteSchemasCache. The only URL filter is a regex that matches ^https?:// — there is no private-IP allowlist, ...

swagger-typescript-api vulnerable to Server-Side Request Forgery via spec `$ref`

Summary swagger-typescript-api walks every $ref value in the input OpenAPI spec and, for any $ref whose target is an https:// URL, issues an HTTP GET to that URL during generation warmUpRemoteSchemasCache. The only URL filter is a regex that matches ^https?:// — there is no private-IP allowlist, ...

GHSA-HQJ5-CW9F-RX67 swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in fetch http-client template

Summary swagger-typescript-api interpolates servers0.url directly into a TypeScript class-body field initializer of the generated fetch HttpClient templates/base/http-clients/fetch-http-client.ejs:75, without any escaping. A malicious URL containing a " closes the string literal that initializes...

swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in fetch http-client template

Summary swagger-typescript-api interpolates servers0.url directly into a TypeScript class-body field initializer of the generated fetch HttpClient templates/base/http-clients/fetch-http-client.ejs:75, without any escaping. A malicious URL containing a " closes the string literal that initializes...

NPM: swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in fetch http-client template

NPM: swagger-typescript-api vulnerable to code injection via unescaped servers0.url in fetch http-client template vulnerability discovered by ? in WordPress Npm swagger-typescript-api versions = 13.12.1...

CVE-2026-54662

swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/code-gen-process.ts createApiConfig copies servers0.url into apiConfig.baseUrl, and templates/base/http-clients/fetch-http-client.ejs interpolates apiConfig.baseUrl into the generate...

CVE-2026-54662 swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in fetch http-client template

swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/code-gen-process.ts createApiConfig copies servers0.url into apiConfig.baseUrl, and templates/base/http-clients/fetch-http-client.ejs interpolates apiConfig.baseUrl into the generate...

CVE-2026-54662 swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in fetch http-client template

swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/code-gen-process.ts createApiConfig copies servers0.url into apiConfig.baseUrl, and templates/base/http-clients/fetch-http-client.ejs interpolates apiConfig.baseUrl into the generate...

EUVD-2026-50363

swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/code-gen-process.ts createApiConfig copies servers0.url into apiConfig.baseUrl, and templates/base/http-clients/fetch-http-client.ejs interpolates apiConfig.baseUrl into the generate...

CVE-2026-54662

Swagger-typescript-api vulnerable to code injection via unescaped servers[0].url in the fetch HTTP client template (CVE-2026-54662). Prior to 13.12.2, createApiConfig copies servers[0].url into apiConfig.baseUrl and fetch-http-client.ejs interpolates it into the generated HttpClient baseUrl witho...

CVE-2026-54660 swagger-typescript-api vulnerable to authorization-token exfiltration via spec `$ref`

swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/resolved-swagger-schema.ts getRemoteRequestHeaders forwards --authorizationToken to every URL fetched by fetchRemoteSchemaDocument while warmUpRemoteSchemasCache resolves external $r...

CVE-2026-54660

swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/resolved-swagger-schema.ts getRemoteRequestHeaders forwards --authorizationToken to every URL fetched by fetchRemoteSchemaDocument while warmUpRemoteSchemasCache resolves external $r...