npmPackage

swagger-typescript-api

6 known vulnerabilities (5 high, 1 medium), with the versions each affects and the releases that fix them.

Latest release: 13.13.0 (Sep 18, 2026): no advisory affects it
Newest unaffected release: 13.13.0 (Sep 18, 2026), the latest release
Advisories: 6 · 5 high, 1 medium

Weekly downloads: 740.6K
Dependents: 101
Releases: 201 since 1.0.0 (Jan 14, 2020)
Registry: npm
Releases read: Nov 8, 2026

Version timeline

CVE-2026-54666
Affects 1.0.0 to 13.12.1 (13.12.2 is outside it)
CVE-2026-54664
Affects 1.0.0 to 13.12.1 (13.12.2 is outside it)
CVE-2026-54661
Affects 1.0.0 to 13.12.1 (13.12.2 is outside it)
CVE-2026-54663
Affects 1.0.0 to 13.12.1 (13.12.2 is outside it)
CVE-2026-54662
Affects 1.0.0 to 13.12.1 (13.12.2 is outside it)
CVE-2026-54660
Affects 1.0.0 to 13.12.1 (13.12.2 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 6

CVE-2026-54666High 8.3
swagger-typescript-api vulnerable to code injection via unescaped OpenAPI path strings in generated method bodies
Affected: fixed in 13.12.2.
Fixed in 13.12.2 (released Jun 8, 2026, 51 days before disclosure).
The latest release, 13.13.0, is not affected.
46% of swagger-typescript-api downloads last week were affected versions (397.4K).
CVE-2026-54664High 8.3
swagger-typescript-api vulnerable to code injection via unescaped enum string values
Affected: fixed in 13.12.2.
Fixed in 13.12.2 (released Jun 8, 2026, 51 days before disclosure).
The latest release, 13.13.0, is not affected.
46% of swagger-typescript-api downloads last week were affected versions (397.4K).
CVE-2026-54661High 8.3
swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in axios http-client template
Affected: fixed in 13.12.2.
Fixed in 13.12.2 (released Jun 8, 2026, 51 days before disclosure).
The latest release, 13.13.0, is not affected.
46% of swagger-typescript-api downloads last week were affected versions (397.4K).
CVE-2026-54663Medium 6.1
swagger-typescript-api vulnerable to Server-Side Request Forgery via spec `$ref`
Affected: fixed in 13.12.2.
Fixed in 13.12.2 (released Jun 8, 2026, 51 days before disclosure).
The latest release, 13.13.0, is not affected.
46% of swagger-typescript-api downloads last week were affected versions (397.4K).
CVE-2026-54662High 8.3
swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in fetch http-client template
Affected: fixed in 13.12.2.
Fixed in 13.12.2 (released Jun 8, 2026, 51 days before disclosure).
The latest release, 13.13.0, is not affected.
46% of swagger-typescript-api downloads last week were affected versions (397.4K).
CVE-2026-54660High 7.4
swagger-typescript-api vulnerable to authorization-token exfiltration via spec `$ref`
Affected: fixed in 13.12.2.
Fixed in 13.12.2 (released Jun 8, 2026, 51 days before disclosure).
The latest release, 13.13.0, is not affected.
46% of swagger-typescript-api downloads last week were affected versions (397.4K).