The pattern that started with Kiota on Sunday now has four entries. datamodel-code-generator picks up twelve more advisories, swagger-typescript-api six, and both come down to the same premise the Kiota batch did: the schema is input, the generated file is Python or TypeScript, and nothing in between checks whether the first should be allowed to become the second. Underneath that, Node.js shipped eleven CVEs across three release lines — three of them high — and a .NET XML advisory surfaces a fix that has been on NuGet for weeks.

Worth your morning

datamodel-code-generator — twelve advisories, five different fix versions. Monday's digest carried one CVE against this tool and pointed at 0.70.0. Twelve more were indexed on July 28, and they are not all closed by the same release: the fixes ladder across 0.60.2, 0.61.0, 0.62.0, 0.63.0 and 0.64.0, so there is no single version that is "the fix" for the batch. The practical answer is that anything from 0.64.0 up has all of them and 0.71.0 is current, which means anyone who took Monday's advice is already covered by accident.

The batch splits three ways. Code execution when the generated module is imported: CVE-2026-54653 (8.8) is the highest number, where a default_factory value from the schema is interpolated verbatim into the generated Field() call as a raw Python expression; CVE-2026-54655 and CVE-2026-54656 (both 7.8) do the same through the x-python-type extension and validators entries. Then SSRF: CVE-2026-54691 (8.2) had --url accepting anything with no host validation and following redirects, CVE-2026-54690 (8.2) the same through a JSON-Schema $ref, and CVE-2026-55391 (7.5) defeats the eventual fix by DNS rebinding — the validator resolves the hostname to decide it's safe, then the fetch resolves it again. Finally file read: CVE-2026-55389 and CVE-2026-55390 (7.5 each) traverse out of the input directory through $ref and XSD schemaLocation, and the advisories note that --no-allow-remote-refs doesn't stop either. The one to read if you only read one is CVE-2026-55415 (7.5), which sets the batch ceiling at 0.64.0 and whose advisory records that the 0.61.0 security patch closed similar sinks and missed these two extensions.

Node.js — eleven CVEs, and the permission model is one of them. The July 29 releases cover 22.x, 24.x and 26.x. Three highs: CVE-2026-56846 has HTTP/2 retaining headers in a way that gets around the maxSessionMemory limit, CVE-2026-56848 is a heap use-after-free on a re-entrant HTTP/2 send, and CVE-2026-58043 has the Permission Model's path matching granting more filesystem access than the allowlist describes — with two lows alongside it for trace events and process reports writing outside that allowlist. The mediums are worth a read if you terminate TLS in Node: one reuses mTLS identities across different PFX certificates, another skips hostname verification on session reuse. Fixed in 22.23.2, 24.18.1 and 26.5.1, which also pull in undici and llhttp updates. If you run an MCP server, an Angular build container, or anything else on a pinned Node image, that image needs rebuilding.

swagger-typescript-api — the same lesson in TypeScript. Six advisories on July 29, all fixed in 13.12.2 and all reachable by generating a client from a spec you didn't write. CVE-2026-54666 (8.3) is the highest: unescaped OpenAPI path strings end up inside generated method bodies, so the injected expression runs every time the generated method is called — a runtime problem in shipped code, not just a build-time one. Two more do it through servers[0].url in the axios and fetch templates, one through enum values. The one to note operationally is CVE-2026-54660 (7.4): when you pass --authorizationToken to fetch a private spec, the token is attached to every request made while resolving external $ref pointers, with no origin check — so a spec that references somewhere else takes your GitHub PAT or SSO bearer with it. 13.12.6 is current.

Also on the agent side, @aws/agentcore CVE-2026-11393 (8.8) is a code-injection flaw in the CLI's Bedrock Agent import path, where collaboration-instruction metadata is interpolated into Python without escaping and runs both locally and in the deployed runtime role. Fixed in 0.14.2, or 1.0.0-preview.9 on the preview line — note this is the npm CLI, not the bedrock-agentcore pip package that took its own high on Friday. And a small one for MCP operators: GHSA-pc2w-4mq8-32qw (low) has the Dynatrace MCP server's create_dynatrace_notebook tool missing its human-approval gate.

On the Venicecom side, System.Security.Cryptography.Xml CVE-2026-32203 (7.5) is a buffer overflow in EncryptedXml reachable with crafted encrypted XML, availability only. It was indexed July 28 but the fix floor is 8.0.3, 9.0.15 and 10.0.6 — and current is 8.0.4, 9.0.18 and 10.0.10, so this is a question about what your project pins rather than something to wait for. Anyone still resolving 8.0.2 transitively should look. Otherwise quiet there: Angular's last security notes stand at June 10, PrimeNG hasn't shipped since 21.1.9 on June 4, and .NET's servicing advisories remain the July 14 batch.

Still unpatched, third day running: the two llama.cpp JSON-schema-to-grammar denial-of-service CVEs (CVE-2026-17500, CVE-2026-17501). Hardening PR #25308 has been open since July 4 with last activity on July 19, so keep schema input inside your trust boundary.