These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-29T15:16:25.990Z and has not been modified since then. The swagger-typescript-api library generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to version 13.12.2, the library passes OpenAPI path keys through parseRouteName to templates/default/procedure-call.ejs and template [truncated]
CVE-2026-54664 is a high-severity vulnerability in swagger-typescript-api that allows code injection through OpenAPI Specifications. The vulnerability can lead to arbitrary code execution when the generated module is imported. Developers and security teams should assess exposure, especially when integrating from untrusted sources, and upgrade to version 13.12.2 or later. The issue is fixed in version 13.1 [truncated]
CVE-2026-54663 is a vulnerability in swagger-typescript-api that allows attacker-controlled OpenAPI specs to make generators issue requests to internal or link-local services. This issue is caused by the src/resolved-swagger-schema.ts file resolving external $ref URLs and fetchRemoteSchemaDocument using isHttpUrl to fetch any http or https target without private IP, redirect, DNS rebinding, or same-origin [truncated]
CVE-2026-54662 is a high-severity vulnerability in swagger-typescript-api that allows code injection via OpenAPI specifications. The vulnerability arises from the insecure interpolation of the baseUrl field in the generated HttpClient without proper escaping, potentially leading to code execution. Developers and security teams should assess exposure, especially when integrating untrusted specifications, a [truncated]
CVE-2026-54661 swagger-typescript-api OpenAPI Specification code injection allows attackers to inject malicious code via OpenAPI Specification, potentially leading to arbitrary code execution during HttpClient or Api construction. Developers and maintainers of API clients generated with swagger-typescript-api, especially those using Axios HttpClient, should assess exposure and update to version 13.12.2 or [truncated]
CVE-2026-54660 is a high-severity vulnerability in swagger-typescript-api that allows token exfiltration. The issue arises from the library's handling of OpenAPI specifications, where the --authorizationToken is forwarded to every URL fetched by fetchRemoteSchemaDocument. This allows an attacker-controlled OpenAPI spec to exfiltrate the developer or CI bearer token to a cross-origin endpoint. The vulnerab [truncated]