CVE-2026-54666
HighCVSS 8.3Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
A code injection vulnerability in swagger-typescript-api (prior to 13.12.2) occurs during API client generation. The parseRouteName function passes OpenAPI path keys to templates without proper escaping of JavaScript template literal interpolation, allowing an attacker to inject ${...} code in the path that executes when the generated method is called.
Risk Assessment
An attacker controlling the OpenAPI spec can inject malicious JavaScript code that executes in the context of the generated API client, leading to application security compromise.
Recommendation
Update swagger-typescript-api to version 13.12.2, which includes the fix for escaping interpolation in templates.
Other vulnerabilities in swagger-typescript-api
See all- CVE-2026-54664High
A code injection vulnerability in swagger-typescript-api (prior to 13.12.2) occurs when processing enum values in OpenAPI schema components. Enum values are passed to Ts.StringValue without escaping before rendering TypeScript enum declarations, allowing an attacker to inject code that executes when the generated module is imported.
- CVE-2026-54663Medium
A vulnerability in swagger-typescript-api (prior to 13.12.2) allows an attacker to use an OpenAPI spec to make requests to internal or link-local services, as the generator does not properly validate external $ref URLs.
- CVE-2026-54662High
A code injection vulnerability in swagger-typescript-api (prior to 13.12.2) occurs when copying the server URL from OpenAPI to apiConfig.baseUrl. The template interpolates apiConfig.baseUrl without escaping, allowing an attacker to inject TypeScript code that executes when the generated fetch client module is imported.
- CVE-2026-54661High
swagger-typescript-api prior to 13.12.2 does not escape the server URL interpolation in the axios-http-client.ejs template. An attacker can supply a malicious OpenAPI spec that injects JavaScript code executed when HttpClient or Api is instantiated.
- CVE-2026-54660High
swagger-typescript-api prior to 13.12.2 forwards the --authorizationToken to every request fetching remote OpenAPI schemas. An attacker can use a malicious spec to exfiltrate this token to an external endpoint.
Original NVD description (English source)
swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, src/schema-routes/schema-routes.ts passes OpenAPI path keys through parseRouteName to templates/default/procedure-call.ejs and templates/modular/procedure-call.ejs without escaping JavaScript template literal interpolation, allowing an attacker-controlled path containing ${...} to execute when the generated method is called. This issue is fixed in version 13.12.2.