Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

swagger-api/swagger-codegen

              master @ c7dd2fc
            

Fixes

CVEs

CRITICAL

Peak severity

37.5%

Coverage

Highlights

Path Traversal: 10 prior fixes. Scrutinize any change in this area.

modules/swagger-codegen: most-fixed (4 issues). Treat as high-risk during review.

9 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Code Injection: User-controlled configuration values, mime types, and metadata parsed from API specifications are directly embedded into Mustache templates during code generation. Failure to consistently sanitize quotes and escape special characters enables arbitrary code execution within the generated source code.

Path Traversal: Generated API clients extract filenames directly from HTTP headers (such as Content-Disposition) and use them to write files on the client machine. Without canonicalization and prefix checks, this allows a malicious server to perform arbitrary file writes on the client system.

Path Traversal: The online generator allows file-system writing and deletion of output artifacts. Without path canonicalization and strict output-directory boundary validation, attackers can write or delete arbitrary files on the hosting system.