restler-fuzzer

RESTler RESTlerとは？ RESTlerは、クラウドサービスのREST APIを介して自動的にテストを行い、セキュリティと信頼性のバグを発見するための、 初のステートフルREST APIファジングツール です。OpenAPI（旧Swagger）仕様を持つクラウドサービスに対し、RESTlerはその仕様全体を解析し、REST APIを通じてサービスをテストするテストを生成・実行します。...

api-security-audit-action

GitHub Action：42Crunch REST API 静态安全测试 REST API 静态安全测试操作会在仓库中查找遵循 OpenAPI 规范（OAS，原名 Swagger）的 REST API 契约，并对其运行全面的安全检查。支持 OAS v2 和 v3.0.x，同时支持 JSON 和 YAML 格式。 你可以在以下场景中使用此操作： 在 CI/CD 工作流中添加自动化的静态 API 安全测试（SAST）任务。 在拉取请求审查和/或代码合并时执行这些检查。 将发现的问题标记到 GitHub 的安全/代码扫描警报中。 该操作由 42Crunch API Security Aud...

OFFAT

OWASP OFFAT OWASP OFFAT（OFFensive Api Tester）は、OpenAPI仕様ファイルからテストを生成した後、APIの一般的な脆弱性を自動的にテストするために作成されました。テスト中にYAML設定ファイルで指定されたユーザー提供の入力を使用したり、入力を自動的にファジングする機能を提供します。 デモ 注意:...

CVE-2026-23947-PoC

演练：CVE-2026-23947 - Orval 任意代码执行 本演练演示了不受信任的 OpenAPI 规范如何利用 x-enumDescriptions 和 x-enumNames 字段，通过 Orval 将任意代码注入到生成的客户端中。 前提条件 Node.js（v20 或 v22） npm 环境搭建 1. 创建一个项目并安装存在漏洞的 orval 版本（例如 7.10.0）： root@kitploit: mkdir orval-poc cd orval-poc npm init -y npm install [email protected] axios 1. 创建...

CVE-2026-76390

In Cisco Talos Intelligence for Enterprise Security Cloud versions below 1.0.3, an unauthenticated user could access the add-on OpenAPI specification through Splunk Web static file paths. The exposed specification could allow for reconnaissance of the add-on Representational State Transfer REST A...

CVE-2026-76390 Information Disclosure through Splunk Web in Cisco Talos Intelligence for Enterprise Security Cloud

In Cisco Talos Intelligence for Enterprise Security Cloud versions below 1.0.3, an unauthenticated user could access the add-on OpenAPI specification through Splunk Web static file paths. The exposed specification could allow for reconnaissance of the add-on Representational State Transfer REST A...

CVE-2026-76390

Cisco Talos Intelligence for Enterprise Security Cloud versions below 1.0.3 expose the add-on's OpenAPI specification through Splunk Web static file paths without requiring authentication. The root cause is that the generated OpenAPI spec is packaged in a static file path that Splunk Web serves u...

PT-2026-78817

Name of the Vulnerable Software and Affected Versions Cisco Talos Intelligence for Enterprise Security Cloud versions prior to 1.0.3 Description An unauthenticated user can access the add-on OpenAPI specification via Splunk Web static file paths. This exposure occurs because the generated OpenAPI...

CVE-2026-54664

swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, src/schema-parser/base-schema-parsers/enum.ts passes components.schemas..enumi values to Ts.StringValue in src/configuration.ts without escaping before...

CVE-2026-54662

swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/code-gen-process.ts createApiConfig copies servers0.url into apiConfig.baseUrl, and templates/base/http-clients/fetch-http-client.ejs interpolates apiConfig.baseUrl into the generate...

CVE-2026-54664 swagger-typescript-api vulnerable to code injection via unescaped enum string values

swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, src/schema-parser/base-schema-parsers/enum.ts passes components.schemas..enumi values to Ts.StringValue in src/configuration.ts without escaping before...

swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in axios http-client template

Summary swagger-typescript-api interpolates servers0.url directly into a TypeScript string literal inside the HttpClient constructor body of the generated axios client templates/base/http-clients/axios-http-client.ejs:71, without any escaping. A malicious URL containing a " closes the string...

CVE-2026-54661

swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, templates/base/http-clients/axios-http-client.ejs interpolates servers0.url from src/code-gen-process.ts into the HttpClient constructor without escaping, allowing an attacker-controll...

CVE-2026-54661 swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in axios http-client template

swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, templates/base/http-clients/axios-http-client.ejs interpolates servers0.url from src/code-gen-process.ts into the HttpClient constructor without escaping, allowing an attacker-controll...

CVE-2026-54663

swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/resolved-swagger-schema.ts warmUpRemoteSchemasCache resolves external $ref URLs and fetchRemoteSchemaDocument uses isHttpUrl to fetch any http or https target without private IP,...

CVE-2026-54662 swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in fetch http-client template

swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/code-gen-process.ts createApiConfig copies servers0.url into apiConfig.baseUrl, and templates/base/http-clients/fetch-http-client.ejs interpolates apiConfig.baseUrl into the generate...

CVE-2026-54660 swagger-typescript-api vulnerable to authorization-token exfiltration via spec `$ref`

swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/resolved-swagger-schema.ts getRemoteRequestHeaders forwards --authorizationToken to every URL fetched by fetchRemoteSchemaDocument while warmUpRemoteSchemasCache resolves external $r...

CVE-2026-47769

APIFold reads an OpenAPI 3.x or Swagger 2.x specification and generates a live, production-ready MCP server endpoint. Prior to commit 7f19b52280f414f57af2b79a95333d1c8fbeece5, the /webhooks/:serverSlug/:eventName endpoint accepts arbitrary unauthenticated JSON and stores it in Redis and the...

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection through PythonConventionService.RemoveInvalidDescriptionCharacters and KiotaBuilder enum description handling in src/Kiota.Builder/Writers/Python and src/Kiota.Builder/KiotaBuilder.cs. An attacker can execute...

CVE-2026-8694

CVE-2026-8694 involves an improper access control flaw in Devolutions PowerShell Universal up to version 2026.1.7, where an unauthenticated remote attacker can obtain the OpenAPI specification of user-defined REST endpoints. The affected component is the OpenAPI/REST endpoint documentation expose...