CVE-2026-54662

swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/code-gen-process.ts createApiConfig copies servers0.url into apiConfig.baseUrl, and templates/base/http-clients/fetch-http-client.ejs interpolates apiConfig.baseUrl into the generate...

swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in fetch http-client template

Summary swagger-typescript-api interpolates servers0.url directly into a TypeScript class-body field initializer of the generated fetch HttpClient templates/base/http-clients/fetch-http-client.ejs:75, without any escaping. A malicious URL containing a " closes the string literal that initializes...

GHSA-HQJ5-CW9F-RX67 swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in fetch http-client template

Summary swagger-typescript-api interpolates servers0.url directly into a TypeScript class-body field initializer of the generated fetch HttpClient templates/base/http-clients/fetch-http-client.ejs:75, without any escaping. A malicious URL containing a " closes the string literal that initializes...

NPM: swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in fetch http-client template

NPM: swagger-typescript-api vulnerable to code injection via unescaped servers0.url in fetch http-client template vulnerability discovered by ? in WordPress Npm swagger-typescript-api versions = 13.12.1...

CVE-2026-54662

Swagger-typescript-api vulnerable to code injection via unescaped servers[0].url in the fetch HTTP client template (CVE-2026-54662). Prior to 13.12.2, createApiConfig copies servers[0].url into apiConfig.baseUrl and fetch-http-client.ejs interpolates it into the generated HttpClient baseUrl witho...

Nodemailer: Improper TLS Certificate Validation in OAuth2 Token Fetch Enables Credential Interception

Summary Nodemailer disables TLS certificate verification in its internal HTTPS fetch client through the use of rejectUnauthorized: false inside lib/fetch/index.js. As a result, OAuth2 token requests trust invalid or self-signed HTTPS certificates and transmit sensitive OAuth credentials over...

CVE-2022-50799 Fetch Softworks Fetch FTP Client 5.8.2 Remote CPU Consumption Denial of Service

Fetch FTP Client 5.8.2 contains a denial of service vulnerability that allows attackers to trigger 100% CPU consumption by sending long server responses. Attackers can send specially crafted FTP server responses exceeding 2K bytes to cause excessive resource utilization and potentially crash the...

@jbrowse/core (>=1.4.0 <=1.7.3), @persistr/js (>=3.6.3 <=3.14.0) +5 more potentially affected by unknown CVE via tenacious-fetch (=2.3.1)

tenacious-fetch NPM version =2.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on tenacious-fetch and may be impacted: - @jbrowse/core =1.4.0, =3.6.3, =1.0.5, =1.0.0, =1.2.0 Source cves: unknown CVE Source advisory: SNYK:JS-TENACIOUSFETCH-14103737...