@easyv/swagger-api-types (0.1.7), @evergis/api (>=4.1.7, <=5.0.46) +22 more potentially affected by CVE-2026-54662 via swagger-typescript-api (>=13.0.1, <=13.6.5)

swagger-typescript-api NPM version =13.0.1, =4.1.7, =1.3.4, =1.4.0, =0.0.65, =0.0.1, =0.0.1, =0.0.7-rc2, =1.2.5, =1.0.7, =0.1.5, =1.2.3, =1.2.6, =2.31.2, =4.8.0 and more Source cves: CVE-2026-54662 Source advisory: OSV:GHSA-HQJ5-CW9F-RX67...

CVE-2026-54662

Swagger-typescript-api vulnerable to code injection via unescaped servers[0].url in the fetch HTTP client template (CVE-2026-54662). Prior to 13.12.2, createApiConfig copies servers[0].url into apiConfig.baseUrl and fetch-http-client.ejs interpolates it into the generated HttpClient baseUrl witho...