CVE-2026-54661 swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in axios http-client template

swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, templates/base/http-clients/axios-http-client.ejs interpolates servers0.url from src/code-gen-process.ts into the HttpClient constructor without escaping, allowing an attacker-controll...

CVE-2026-54661

CVE-2026-54661 affects swagger-typescript-api where, prior to 13.12.2, templates/base/http-clients/axios-http-client.ejs interpolates servers[0].url into the HttpClient constructor without escaping. This allows attacker-controlled OpenAPI specs to inject code that executes when new HttpClient() o...

NPM: swagger-typescript-api vulnerable to Server-Side Request Forgery via spec `$ref`

NPM: swagger-typescript-api vulnerable to Server-Side Request Forgery via spec $ref vulnerability discovered by ? in WordPress Npm swagger-typescript-api versions = 13.12.1...

swagger-typescript-api vulnerable to Server-Side Request Forgery via spec `$ref`

Summary swagger-typescript-api walks every $ref value in the input OpenAPI spec and, for any $ref whose target is an https:// URL, issues an HTTP GET to that URL during generation warmUpRemoteSchemasCache. The only URL filter is a regex that matches ^https?:// — there is no private-IP allowlist, ...

CVE-2026-54663 swagger-typescript-api vulnerable to Server-Side Request Forgery via spec `$ref`

swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/resolved-swagger-schema.ts warmUpRemoteSchemasCache resolves external $ref URLs and fetchRemoteSchemaDocument uses isHttpUrl to fetch any http or https target without private IP,...

CVE-2026-54663 swagger-typescript-api vulnerable to Server-Side Request Forgery via spec `$ref`

swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/resolved-swagger-schema.ts warmUpRemoteSchemasCache resolves external $ref URLs and fetchRemoteSchemaDocument uses isHttpUrl to fetch any http or https target without private IP,...

EUVD-2026-50364

swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/resolved-swagger-schema.ts warmUpRemoteSchemasCache resolves external $ref URLs and fetchRemoteSchemaDocument uses isHttpUrl to fetch any http or https target without private IP,...

CVE-2026-54663 swagger-typescript-api vulnerable to Server-Side Request Forgery via spec `$ref`

swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/resolved-swagger-schema.ts warmUpRemoteSchemasCache resolves external $ref URLs and fetchRemoteSchemaDocument uses isHttpUrl to fetch any http or https target without private IP,...

GHSA-HQJ5-CW9F-RX67 swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in fetch http-client template

Summary swagger-typescript-api interpolates servers0.url directly into a TypeScript class-body field initializer of the generated fetch HttpClient templates/base/http-clients/fetch-http-client.ejs:75, without any escaping. A malicious URL containing a " closes the string literal that initializes...

swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in fetch http-client template

Summary swagger-typescript-api interpolates servers0.url directly into a TypeScript class-body field initializer of the generated fetch HttpClient templates/base/http-clients/fetch-http-client.ejs:75, without any escaping. A malicious URL containing a " closes the string literal that initializes...

NPM: swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in fetch http-client template

NPM: swagger-typescript-api vulnerable to code injection via unescaped servers0.url in fetch http-client template vulnerability discovered by ? in WordPress Npm swagger-typescript-api versions = 13.12.1...

CVE-2026-54662 swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in fetch http-client template

swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/code-gen-process.ts createApiConfig copies servers0.url into apiConfig.baseUrl, and templates/base/http-clients/fetch-http-client.ejs interpolates apiConfig.baseUrl into the generate...

EUVD-2026-50363

swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/code-gen-process.ts createApiConfig copies servers0.url into apiConfig.baseUrl, and templates/base/http-clients/fetch-http-client.ejs interpolates apiConfig.baseUrl into the generate...

CVE-2026-54662

Swagger-typescript-api vulnerable to code injection via unescaped servers[0].url in the fetch HTTP client template (CVE-2026-54662). Prior to 13.12.2, createApiConfig copies servers[0].url into apiConfig.baseUrl and fetch-http-client.ejs interpolates it into the generated HttpClient baseUrl witho...

CVE-2026-54662 swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in fetch http-client template

swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/code-gen-process.ts createApiConfig copies servers0.url into apiConfig.baseUrl, and templates/base/http-clients/fetch-http-client.ejs interpolates apiConfig.baseUrl into the generate...

NPM: swagger-typescript-api vulnerable to authorization-token exfiltration via spec `$ref`

NPM: swagger-typescript-api vulnerable to authorization-token exfiltration via spec $ref vulnerability discovered by ? in WordPress Npm swagger-typescript-api versions = 13.12.1...

CVE-2026-54660 swagger-typescript-api vulnerable to authorization-token exfiltration via spec `$ref`

swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/resolved-swagger-schema.ts getRemoteRequestHeaders forwards --authorizationToken to every URL fetched by fetchRemoteSchemaDocument while warmUpRemoteSchemasCache resolves external $r...

EUVD-2026-50361

swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/resolved-swagger-schema.ts getRemoteRequestHeaders forwards --authorizationToken to every URL fetched by fetchRemoteSchemaDocument while warmUpRemoteSchemasCache resolves external $r...

CVE-2026-54660 swagger-typescript-api vulnerable to authorization-token exfiltration via spec `$ref`

swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/resolved-swagger-schema.ts getRemoteRequestHeaders forwards --authorizationToken to every URL fetched by fetchRemoteSchemaDocument while warmUpRemoteSchemasCache resolves external $r...

CVE-2026-54660

swagger-typescript-api prior to 13.12.2 forwards the Authorization token to every external $ref request during openapi schema resolution, enabling token exfiltration to attacker-controlled endpoints. The root cause is getRemoteRequestHeaders attaching the token to all fetchRemoteSchemaDocument ca...