https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 10:12:32 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-342758 EUVD-2026-342758 https://cve.radiocsirt.org/vuln/euvd-2026-342758 https://cve.radiocsirt.org/vuln/fkie_cve-2026-54664 <p>swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, src/schema-parser/base-schema-parsers/enum.ts passes components.schemas.*.enum[i] values to Ts.StringValue in src/configuration.ts without escaping before templates/base/enum-data-contract.ejs renders TypeScript enum declarations, allowing an attacker-controlled OpenAPI spec to inject code that executes when the generated module is imported. This issue is fixed in version 13.12.2.</p> <p>swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, src/schema-parser/base-schema-parsers/enum.ts passes components.schemas.*.enum[i] values to Ts.StringValue in src/configuration.ts without escaping before templates/base/enum-data-contract.ejs renders TypeScript enum declarations, allowing an attacker-controlled OpenAPI spec to inject code that executes when the generated module is imported. This issue is fixed in version 13.12.2.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-54664 https://cve.radiocsirt.org/vuln/ghsa-5f94-x226-ccpm <p><strong>Affected:</strong> npm: swagger-typescript-api</p> <p>### Summary</p> <p>`swagger-typescript-api` interpolates `components.schemas.*.enum[i]` string values into the body of generated TypeScript `enum` declarations without escaping. A malicious enum value can close the enclosing string literal, terminate the enum body, and inject a bare-block IIFE that executes at **module load** the first time the generated client is imported. The trigger requires no instantiation and no method call — only an `import` of the generated module. The attacker controls the OpenAPI spec (remote `--url`, third-party / public spec, multi-tenant platform); the victim is whoever runs the generator and imports the result (the developer, their CI runner, or any downstream consumer of the generated package). Impact is arbitrary code execution with the importing process&#39;s privileges — read any file the importer can read, write any file, exfiltrate secrets, etc.</p> <p>### Details</p> <p>The root cause is `Ts.StringValue` in `src/configuration.ts:250`:</p> <p>```ts StringValue: (content: unknown) =&gt; `&#34;${content}&#34;`, ```</p> <p>It wraps a value in double quotes with **zero escaping** — no handling of `&#34;`, `\`, newlines, or anything else. The codebase&#39;s only escape function (`escapeJSDocContent` in `src/schema-parser/schema-formatters.ts:127`) only replaces `*/` and is never applied to this path.</p> <p>Enum string values reach `Ts.StringValue` at `src/schema-parser/base-schema-parsers/enum.ts:100` and `:116`:</p> <p>```ts return this.config.Ts.StringValue(value); // ... value: this.config.Ts.StringValu…</p> <p><strong>Affected:</strong> npm: swagger-typescript-api</p> <p>### Summary</p> <p>`swagger-typescript-api` interpolates `components.schemas.*.enum[i]` string values into the body of generated TypeScript `enum` declarations without escaping. A malicious enum value can close the enclosing string literal, terminate the enum body, and inject a bare-block IIFE that executes at **module load** the first time the generated client is imported. The trigger requires no instantiation and no method call — only an `import` of the generated module. The attacker controls the OpenAPI spec (remote `--url`, third-party / public spec, multi-tenant platform); the victim is whoever runs the generator and imports the result (the developer, their CI runner, or any downstream consumer of the generated package). Impact is arbitrary code execution with the importing process&#39;s privileges — read any file the importer can read, write any file, exfiltrate secrets, etc.</p> <p>### Details</p> <p>The root cause is `Ts.StringValue` in `src/configuration.ts:250`:</p> <p>```ts StringValue: (content: unknown) =&gt; `&#34;${content}&#34;`, ```</p> <p>It wraps a value in double quotes with **zero escaping** — no handling of `&#34;`, `\`, newlines, or anything else. The codebase&#39;s only escape function (`escapeJSDocContent` in `src/schema-parser/schema-formatters.ts:127`) only replaces `*/` and is never applied to this path.</p> <p>Enum string values reach `Ts.StringValue` at `src/schema-parser/base-schema-parsers/enum.ts:100` and `:116`:</p> <p>```ts return this.config.Ts.StringValue(value); // ... value: this.config.Ts.StringValu…</p> https://cve.radiocsirt.org/vuln/ghsa-5f94-x226-ccpm