EUVD-2026-96346

openapi-typescript-codegen through 0.31.0 contains a code injection vulnerability that allows attackers controlling an OpenAPI document to inject JavaScript by supplying unescaped values interpolated into single-quoted string literals. Attackers can embed a single quote in path keys, parameter...

CVE-2026-108551

openapi-typescript-codegen through 0.31.0 contains a code injection vulnerability that allows attackers controlling an OpenAPI document to inject JavaScript by supplying unescaped values interpolated into single-quoted string literals. Attackers can embed a single quote in path keys, parameter...

CVE-2026-108551 openapi-typescript-codegen through 0.31.0 Code Injection via Handlebars Templates

openapi-typescript-codegen through 0.31.0 contains a code injection vulnerability that allows attackers controlling an OpenAPI document to inject JavaScript by supplying unescaped values interpolated into single-quoted string literals. Attackers can embed a single quote in path keys, parameter...

CVE-2026-108551: Improper Control of Generation of Code

openapi-typescript-codegen through 0.31.0 contains a code injection vulnerability that allows attackers controlling an OpenAPI document to inject JavaScript by supplying unescaped values interpolated into single-quoted string literals. Attackers can embed a single quote in path keys, parameter...

PT-2026-109666

Name of the Vulnerable Software and Affected Versions openapi-typescript-codegen versions prior to 0.31.1 Description Code injection occurs when the software processes an OpenAPI document containing unescaped values interpolated into single-quoted string literals. An attacker controlling the...

Tina: Code injection via unescaped Git branch name in generated client source

Summary @tinacms/cli inserts the raw Git branch value into the generated client.ts source without escaping or encoding. A Git-valid branch name can close the string literal and inject an arbitrary JavaScript expression that executes when the consumer build imports the generated client module...

Always-Incorrect Control Flow Implementation

Overview vyper is a Pythonic Smart Contract Language for the EVM. Affected versions of this package are vulnerable to Always-Incorrect Control Flow Implementation in makereturnstmt in vyper/codegen/return.py when a return statement is executed inside a for loop, the loop's values are not popped...

Rocky Linux 8.8 [CIQ] Security Update: pygobject2 / pygobject2-codegen / pygobject2-debuginfo / etc Multiple Vulnerabilities (ciqsa-2026_0294)

The Rocky Linux 8.8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20260294 advisory. This advisory aggregates security fixes for the pygobject2 SRPM in CIQ LTS 8.8. It addresses 2 CVEs: CVE-2023-44442, CVE-2023-44444. Tenable has extracte...

Rocky Linux 8.8 [CIQ] Security Update: pygtk2 / pygtk2-codegen / pygtk2-debuginfo / pygtk2-debugsource / etc Multiple Vulnerabilities (ciqsa-2026_0292)

The Rocky Linux 8.8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-20260292 advisory. This advisory aggregates security fixes for the pygtk2 SRPM in CIQ LTS 8.8. It addresses 2 CVEs: CVE-2023-44442, CVE-2023-44444. Tenable has extracted th...

Malicious Package

Overview @hrmony/pladddform-codegen is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malware in @hrmony/pladddform-codegen

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in @hrmony/pladddform-codegen (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 58f0706d7223f8a1ff87ac80c6e1e42af148214545e55acc865cce12fee7eec4 On module load, index.js unconditionally beacons to the hardcoded non-first-party endpoint...

MAL-2026-17273 Malicious code in @hrmony/pladddform-codegen (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 58f0706d7223f8a1ff87ac80c6e1e42af148214545e55acc865cce12fee7eec4 On module load, index.js unconditionally beacons to the hardcoded non-first-party endpoint...

Malicious Package

Overview epic-openapi-codegen is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

@hanzo/openapi-codegen (0.0.0), @testurio/cli (>=0.6.3, <=0.7.3) +3 more potentially affected by CVE-2026-96757 via @orval/mock (>=8.4.0, <=8.28.1)

@orval/mock NPM version =8.4.0, =0.6.3, =8.9.1, =8.7.0-patch1, =8.4.0, =8.28.1 Source cves: CVE-2026-96757 Source advisory: MEND:CVE-2026-96757...

Malicious code in eth-codegen (npm)

Source: amazon-inspector c111948c855e4133fbd037c268523a2118038ca498e9bdba1c743d4ee77f24bc The package advertises itself as an Ethereum codegen utility but its actual contents are an unrelated mongoose leanhooks plugin plus a hidden dropper. index.js appends an async runHandler concealed after 1KB...

Malicious code in epic-openapi-codegen (npm)

Source: amazon-inspector 72c376cbf488eb74d4d24b10cd6153640f94a3ceb831332dc1f0f056934c91ed The package epic-openapi-codegen was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in circuit-codegen-annotations (npm)

--- Credit: OpenSSF source...

Malicious code in circuit-codegen-annotations-test (npm)

--- Credit: OpenSSF source...

EUVD-2026-68930

URL Redirection to Untrusted Site 'Open Redirect' vulnerability in ash-project ashtypescript allows an attacker who controls a path-parameter value to redirect a generated client's request, and the credentials attached to it, to an unintended route or an external origin. The URL builders in...