swagger-typescript-api vulnerabilities

A code injection vulnerability in swagger-typescript-api (prior to 13.12.2) occurs during API client generation. The parseRouteName function passes OpenAPI path keys to templates without proper escaping of JavaScript template literal interpolation, allowing an attacker to inject ${...} code in the path that executes when the generated method is called.

A code injection vulnerability in swagger-typescript-api (prior to 13.12.2) occurs when processing enum values in OpenAPI schema components. Enum values are passed to Ts.StringValue without escaping before rendering TypeScript enum declarations, allowing an attacker to inject code that executes when the generated module is imported.

A vulnerability in swagger-typescript-api (prior to 13.12.2) allows an attacker to use an OpenAPI spec to make requests to internal or link-local services, as the generator does not properly validate external $ref URLs.

A code injection vulnerability in swagger-typescript-api (prior to 13.12.2) occurs when copying the server URL from OpenAPI to apiConfig.baseUrl. The template interpolates apiConfig.baseUrl without escaping, allowing an attacker to inject TypeScript code that executes when the generated fetch client module is imported.

swagger-typescript-api prior to 13.12.2 does not escape the server URL interpolation in the axios-http-client.ejs template. An attacker can supply a malicious OpenAPI spec that injects JavaScript code executed when HttpClient or Api is instantiated.

swagger-typescript-api prior to 13.12.2 forwards the --authorizationToken to every request fetching remote OpenAPI schemas. An attacker can use a malicious spec to exfiltrate this token to an external endpoint.