CVE-2026-54661

CVE-2026-54661 affects swagger-typescript-api where, prior to 13.12.2, templates/base/http-clients/axios-http-client.ejs interpolates servers[0].url into the HttpClient constructor without escaping. This allows attacker-controlled OpenAPI specs to inject code that executes when new HttpClient() o...