112097 matches found
swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in axios http-client template
Summary swagger-typescript-api interpolates servers0.url directly into a TypeScript string literal inside the HttpClient constructor body of the generated axios client templates/base/http-clients/axios-http-client.ejs:71, without any escaping. A malicious URL containing a " closes the string...
CVE-2026-54661
swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, templates/base/http-clients/axios-http-client.ejs interpolates servers0.url from src/code-gen-process.ts into the HttpClient constructor without escaping, allowing an attacker-controll...
CVE-2026-54661
CVE-2026-54661 affects swagger-typescript-api where, prior to 13.12.2, templates/base/http-clients/axios-http-client.ejs interpolates servers[0].url into the HttpClient constructor without escaping. This allows attacker-controlled OpenAPI specs to inject code that executes when new HttpClient() o...
CVE-2026-54661 swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in axios http-client template
swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, templates/base/http-clients/axios-http-client.ejs interpolates servers0.url from src/code-gen-process.ts into the HttpClient constructor without escaping, allowing an attacker-controll...
CVE-2026-54661 swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in axios http-client template
swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, templates/base/http-clients/axios-http-client.ejs interpolates servers0.url from src/code-gen-process.ts into the HttpClient constructor without escaping, allowing an attacker-controll...
GHSA-HQJ5-CW9F-RX67 swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in fetch http-client template
Summary swagger-typescript-api interpolates servers0.url directly into a TypeScript class-body field initializer of the generated fetch HttpClient templates/base/http-clients/fetch-http-client.ejs:75, without any escaping. A malicious URL containing a " closes the string literal that initializes...
swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in fetch http-client template
Summary swagger-typescript-api interpolates servers0.url directly into a TypeScript class-body field initializer of the generated fetch HttpClient templates/base/http-clients/fetch-http-client.ejs:75, without any escaping. A malicious URL containing a " closes the string literal that initializes...
NPM: swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in fetch http-client template
NPM: swagger-typescript-api vulnerable to code injection via unescaped servers0.url in fetch http-client template vulnerability discovered by ? in WordPress Npm swagger-typescript-api versions = 13.12.1...
CVE-2026-54662 swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in fetch http-client template
swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/code-gen-process.ts createApiConfig copies servers0.url into apiConfig.baseUrl, and templates/base/http-clients/fetch-http-client.ejs interpolates apiConfig.baseUrl into the generate...
EUVD-2026-50363
swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/code-gen-process.ts createApiConfig copies servers0.url into apiConfig.baseUrl, and templates/base/http-clients/fetch-http-client.ejs interpolates apiConfig.baseUrl into the generate...
CVE-2026-13423
creationtimestamp| type| source ---|---|--- 2026-07-29 13:32:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrrzxmig3523...
CVE-2019-13118
creationtimestamp| type| source ---|---|--- 2026-07-29 12:03:23+00:00| seen| https://t.me/linuxnews/592 2026-07-30 00:03:09+00:00| seen| https://t.me/linuxnews/592 2026-08-04 06:00:04+00:00| seen| https://t.me/linuxnews/592 2026-08-05 00:00:53+00:00| seen| https://t.me/linuxnews/592...
CVE-2021-34462
creationtimestamp| type| source ---|---|--- 2026-07-29 12:02:34+00:00| seen| https://t.me/reverseame/3088 2026-07-30 00:02:32+00:00| seen| https://t.me/reverseame/3088 2026-08-02 20:15:15+00:00| published-proof-of-concept| https://t.me/reverseame/3088 2026-08-03 01:11:29+00:00|...
CVE-2023-233397
creationtimestamp| type| source ---|---|--- 2026-07-29 12:02:22+00:00| seen| https://t.me/reverseame/4066 2026-07-30 00:02:24+00:00| seen| https://t.me/reverseame/4066 2026-08-02 10:04:23+00:00| published-proof-of-concept| https://t.me/reverseame/4066 2026-08-03 02:07:13+00:00|...
CVE-2026-58186
creationtimestamp| type| source ---|---|--- 2026-07-29 12:01:46+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrruw54hma23 2026-08-01 05:37:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mryqt2qdmn2r...
CVE-2026-13110
creationtimestamp| type| source ---|---|--- 2026-07-29 11:39:39+00:00| seen| https://bsky.app/profile/cybersecinsight.bsky.social/post/3mrrtoltjdn2c...
CVE-2026-11973
creationtimestamp| type| source ---|---|--- 2026-07-29 11:36:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrrtjelgw42b...
CVE-2026-13425
creationtimestamp| type| source ---|---|--- 2026-07-29 11:36:38+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mrrtj6pzpx23 2026-07-29 11:51:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mrrue7z7kt2b...
CVE-2026-58179
creationtimestamp| type| source ---|---|--- 2026-07-29 11:28:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrrszuuitx2z 2026-07-30 09:22:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mru4hhitrt2s 2026-07-30 16:34:03+00:00| seen|...