CVE-2026-54660
HighCVSS 7.4Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
swagger-typescript-api prior to 13.12.2 forwards the --authorizationToken to every request fetching remote OpenAPI schemas. An attacker can use a malicious spec to exfiltrate this token to an external endpoint.
Risk Assessment
Token exfiltration can allow an attacker to impersonate the developer or CI system, gaining unauthorized access to resources.
Recommendation
Upgrade swagger-typescript-api to version 13.12.2 which removes this behavior.
Other vulnerabilities in swagger-typescript-api
See all- CVE-2026-54666High
A code injection vulnerability in swagger-typescript-api (prior to 13.12.2) occurs during API client generation. The parseRouteName function passes OpenAPI path keys to templates without proper escaping of JavaScript template literal interpolation, allowing an attacker to inject ${...} code in the path that executes when the generated method is called.
- CVE-2026-54664High
A code injection vulnerability in swagger-typescript-api (prior to 13.12.2) occurs when processing enum values in OpenAPI schema components. Enum values are passed to Ts.StringValue without escaping before rendering TypeScript enum declarations, allowing an attacker to inject code that executes when the generated module is imported.
- CVE-2026-54663Medium
A vulnerability in swagger-typescript-api (prior to 13.12.2) allows an attacker to use an OpenAPI spec to make requests to internal or link-local services, as the generator does not properly validate external $ref URLs.
- CVE-2026-54662High
A code injection vulnerability in swagger-typescript-api (prior to 13.12.2) occurs when copying the server URL from OpenAPI to apiConfig.baseUrl. The template interpolates apiConfig.baseUrl without escaping, allowing an attacker to inject TypeScript code that executes when the generated fetch client module is imported.
- CVE-2026-54661High
swagger-typescript-api prior to 13.12.2 does not escape the server URL interpolation in the axios-http-client.ejs template. An attacker can supply a malicious OpenAPI spec that injects JavaScript code executed when HttpClient or Api is instantiated.
Original NVD description (English source)
swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/resolved-swagger-schema.ts getRemoteRequestHeaders forwards --authorizationToken to every URL fetched by fetchRemoteSchemaDocument while warmUpRemoteSchemasCache resolves external $ref URLs, allowing an attacker-controlled OpenAPI spec to exfiltrate the developer or CI bearer token to a cross-origin endpoint. This issue is fixed in version 13.12.2.