CVE-2026-54664
HighCVSS 8.3Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
A code injection vulnerability in swagger-typescript-api (prior to 13.12.2) occurs when processing enum values in OpenAPI schema components. Enum values are passed to Ts.StringValue without escaping before rendering TypeScript enum declarations, allowing an attacker to inject code that executes when the generated module is imported.
Risk Assessment
An attacker controlling the OpenAPI spec can inject malicious TypeScript code that executes upon importing the generated module, potentially leading to application compromise.
Recommendation
Update swagger-typescript-api to version 13.12.2, which includes the fix for escaping enum values.
Other vulnerabilities in swagger-typescript-api
See all- CVE-2026-54666High
A code injection vulnerability in swagger-typescript-api (prior to 13.12.2) occurs during API client generation. The parseRouteName function passes OpenAPI path keys to templates without proper escaping of JavaScript template literal interpolation, allowing an attacker to inject ${...} code in the path that executes when the generated method is called.
- CVE-2026-54663Medium
A vulnerability in swagger-typescript-api (prior to 13.12.2) allows an attacker to use an OpenAPI spec to make requests to internal or link-local services, as the generator does not properly validate external $ref URLs.
- CVE-2026-54662High
A code injection vulnerability in swagger-typescript-api (prior to 13.12.2) occurs when copying the server URL from OpenAPI to apiConfig.baseUrl. The template interpolates apiConfig.baseUrl without escaping, allowing an attacker to inject TypeScript code that executes when the generated fetch client module is imported.
- CVE-2026-54661High
swagger-typescript-api prior to 13.12.2 does not escape the server URL interpolation in the axios-http-client.ejs template. An attacker can supply a malicious OpenAPI spec that injects JavaScript code executed when HttpClient or Api is instantiated.
- CVE-2026-54660High
swagger-typescript-api prior to 13.12.2 forwards the --authorizationToken to every request fetching remote OpenAPI schemas. An attacker can use a malicious spec to exfiltrate this token to an external endpoint.
Original NVD description (English source)
swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, src/schema-parser/base-schema-parsers/enum.ts passes components.schemas.*.enum[i] values to Ts.StringValue in src/configuration.ts without escaping before templates/base/enum-data-contract.ejs renders TypeScript enum declarations, allowing an attacker-controlled OpenAPI spec to inject code that executes when the generated module is imported. This issue is fixed in version 13.12.2.