CVE-2026-54661
HighCVSS 8.3Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
swagger-typescript-api prior to 13.12.2 does not escape the server URL interpolation in the axios-http-client.ejs template. An attacker can supply a malicious OpenAPI spec that injects JavaScript code executed when HttpClient or Api is instantiated.
Risk Assessment
Code injection can lead to client-side compromise, data theft, or further attacks on internal systems.
Recommendation
Upgrade swagger-typescript-api to version 13.12.2 or later immediately.
Other vulnerabilities in swagger-typescript-api
See all- CVE-2026-54666High
A code injection vulnerability in swagger-typescript-api (prior to 13.12.2) occurs during API client generation. The parseRouteName function passes OpenAPI path keys to templates without proper escaping of JavaScript template literal interpolation, allowing an attacker to inject ${...} code in the path that executes when the generated method is called.
- CVE-2026-54664High
A code injection vulnerability in swagger-typescript-api (prior to 13.12.2) occurs when processing enum values in OpenAPI schema components. Enum values are passed to Ts.StringValue without escaping before rendering TypeScript enum declarations, allowing an attacker to inject code that executes when the generated module is imported.
- CVE-2026-54663Medium
A vulnerability in swagger-typescript-api (prior to 13.12.2) allows an attacker to use an OpenAPI spec to make requests to internal or link-local services, as the generator does not properly validate external $ref URLs.
- CVE-2026-54662High
A code injection vulnerability in swagger-typescript-api (prior to 13.12.2) occurs when copying the server URL from OpenAPI to apiConfig.baseUrl. The template interpolates apiConfig.baseUrl without escaping, allowing an attacker to inject TypeScript code that executes when the generated fetch client module is imported.
- CVE-2026-54660High
swagger-typescript-api prior to 13.12.2 forwards the --authorizationToken to every request fetching remote OpenAPI schemas. An attacker can use a malicious spec to exfiltrate this token to an external endpoint.
Original NVD description (English source)
swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, templates/base/http-clients/axios-http-client.ejs interpolates servers[0].url from src/code-gen-process.ts into the HttpClient constructor without escaping, allowing an attacker-controlled OpenAPI spec to inject code that executes when new HttpClient() or new Api() is constructed. This issue is fixed in version 13.12.2.