https://vulnerability.circl.lu/sightings/feed 2026-07-30T23:11:01.437590+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/97121651-4dd4-4314-8858-3c39c24b89a7/export 2026-07-30T23:11:01.456896+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "97121651-4dd4-4314-8858-3c39c24b89a7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54666", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mrsl2b6tt524", "content": "CVE-2026-54666 - swagger-typescript-api vulnerable to code injection via unescaped OpenAPI path strings in generated method bodies\nCVE ID : CVE-2026-54666\n \n Published : July 29, 2026, 3:16 p.m. | 2\u00a0hours, 28\u00a0minutes ago\n \n Description : swagger-typescript-api generates API cl...", "creation_timestamp": "2026-07-29T18:37:47.424633Z"} 2026-07-29T18:37:47.424633+00:00 https://vulnerability.circl.lu/sighting/4373d506-7162-4c98-bf10-66c29e401b41/export 2026-07-30T23:11:01.459176+00:00 Joseph Lee https://cve.circl.lu/user/syspect {"uuid": "4373d506-7162-4c98-bf10-66c29e401b41", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-54666", "type": "published-proof-of-concept", "source": "https://github.com/acacode/swagger-typescript-api/security/advisories/GHSA-w284-33mx-6g9v", "content": "", "creation_timestamp": "2026-07-29T16:35:12.328683Z"} 2026-07-29T16:35:12.328683+00:00 https://vulnerability.circl.lu/sighting/3ffd62d5-29ff-47d1-8c2e-5cb7229daace/export 2026-07-30T23:11:01.460842+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "3ffd62d5-29ff-47d1-8c2e-5cb7229daace", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54666", "type": "seen", "source": "https://gist.github.com/alon710/2872dac20223d7dd754cee0ee5c0587f", "content": "# CVE-2026-54666: CVE-2026-54666: Remote Code Execution via OpenAPI Route Path Injection in swagger-typescript-api\n\n> **CVSS Score:** 8.3\n> **Published:** 2026-07-29\n> **Full Report:** https://cvereports.com/reports/CVE-2026-54666\n\n## Summary\nCVE-2026-54666 identifies a high-severity code injection vulnerability in the swagger-typescript-api code generator library. The library fails to sanitize route paths parsed from OpenAPI Specification (OAS) documents before interpolating them into generated TypeScript and JavaScript client code. When a developer processes a compromised or malicious OpenAPI specification file, the library writes unescaped string literals and dynamic execution blocks directly into backtick template literals. When the generated client's corresponding API method is executed, the embedded JavaScript executes dynamically with the privileges of the active process.\n\n## TL;DR\nThe swagger-typescript-api code generator fails to sanitize route paths. An attacker can craft a malicious OpenAPI specification with embedded JavaScript in a route path to execute arbitrary code when the generated API client is run.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-94 / CWE-1336\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1 Score**: 8.3\n- **Exploit Status**: Proof-of-Concept\n- **CISA KEV Status**: Not Listed\n- **Ecosystem**: npm\n\n## Affected Systems\n\n- swagger-typescript-api npm package versions prior to 13.12.2\n- **swagger-typescript-api**: < 13.12.2 (Fixed in: `13.12.2`)\n\n## Mitigation\n\n- Upgrade swagger-typescript-api to version 13.12.2 or later.\n- Scan all generated client source code files for unescaped expressions inside template literals.\n- Implement strict schema validation to block route definitions that contain special characters like backticks or execution strings.\n\n**Remediation Steps:**\n1. Open your project directory and execute the package manager upgrade command: `npm install swagger-typescript-api@13.12.2`.\n2. Inspect the generated configuration and files (such as `Api.ts` or `HttpClient.ts`) for instances of `path: ` containing `${` characters.\n3. Integrate automated linting or security scanning into build pipelines to block deployment if unescaped patterns are matched.\n\n## References\n\n- [GitHub Security Advisory GHSA-w284-33mx-6g9v](https://github.com/acacode/swagger-typescript-api/security/advisories/GHSA-w284-33mx-6g9v)\n- [GitHub Pull Request #1779](https://github.com/acacode/swagger-typescript-api/pull/1779)\n- [Fix Commit 306d59a](https://github.com/acacode/swagger-typescript-api/commit/306d59acb8ffbb00f953f807b97234b21f51d9de)\n- [CVE-2026-54666 Record](https://www.cve.org/CVERecord?id=CVE-2026-54666)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-54666) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-29T15:31:13.143382Z"} 2026-07-29T15:31:13.143382+00:00