13 matches found
EUVD-2026-62599
Orval: RCE via OpenAPI path - unescaped request-URL template literal backtick breakout...
CVE-2026-62681 Orval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout)
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, an unescaped backtick in an OpenAPI path is emitted into request URL template literals generated for axios, fetch, react-query, and SWR clients without safe encoding. This...
CVE-2026-62681
In Orval
PT-2026-78545
Name of the Vulnerable Software and Affected Versions Orval versions prior to 8.21.0 Description An issue exists where unescaped backticks in an OpenAPI path are emitted into request URL template literals for axios, fetch, react-query, and SWR clients without safe encoding. This allows...
swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in axios http-client template
Summary swagger-typescript-api interpolates servers0.url directly into a TypeScript string literal inside the HttpClient constructor body of the generated axios client templates/base/http-clients/axios-http-client.ejs:71, without any escaping. A malicious URL containing a " closes the string...
EUVD-2026-50365
swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, templates/base/http-clients/axios-http-client.ejs interpolates servers0.url from src/code-gen-process.ts into the HttpClient constructor without escaping, allowing an attacker-controll...
CVE-2026-54661 swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in axios http-client template
swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, templates/base/http-clients/axios-http-client.ejs interpolates servers0.url from src/code-gen-process.ts into the HttpClient constructor without escaping, allowing an attacker-controll...
CVE-2026-42038
Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, he fix for noproxy hostname normalization bypass is incomplete. When noproxy=localhost is set, requests to 127.0.0.1 and ::1 still route through the proxy instead of bypassing it. The shouldBypassProxy...
Axios 安全漏洞
Axios is an open-source HTTP client developed by Axios. Versions of Axios prior to 1.15.1 and 0.31.1 contain security vulnerabilities. These vulnerabilities stem from a character mapping in the encode function, where empty bytes encoded with the security percent symbol are reversed back to origin...
MAL-2025-47529 Malicious code in @sev-ui-verse/axios-client (npm)
The package @sev-ui-verse/axios-client was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1269bc295bd18df400a37252d2489c129bf609786ec262427cfcde7bd57f8de4 Any computer that has this package installed or running should be considered...
Malicious code in @sev-ui-verse/axios-client (npm)
The package @sev-ui-verse/axios-client was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1269bc295bd18df400a37252d2489c129bf609786ec262427cfcde7bd57f8de4 Any computer that has this package installed or running should be considered...