CVE-2026-54661 in swagger-typescript-api
Zusammenfassung
von MITRE • 29.07.2026
swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, templates/base/http-clients/axios-http-client.ejs interpolates servers[0].url from src/code-gen-process.ts into the HttpClient constructor without escaping, allowing an attacker-controlled OpenAPI spec to inject code that executes when new HttpClient() or new Api() is constructed. This issue is fixed in version 13.12.2.
If you want to get best quality of vulnerability data, you may have to visit VulDB.