CVE-2026-54661

CVE-2026-54661 affects swagger-typescript-api where, prior to 13.12.2, templates/base/http-clients/axios-http-client.ejs interpolates servers[0].url into the HttpClient constructor without escaping. This allows attacker-controlled OpenAPI specs to inject code that executes when new HttpClient() o...

CVE-2026-54661 swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in axios http-client template

swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, templates/base/http-clients/axios-http-client.ejs interpolates servers0.url from src/code-gen-process.ts into the HttpClient constructor without escaping, allowing an attacker-controll...