CVE-2026-54661 Details
Description
swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, templates/base/http-clients/axios-http-client.ejs interpolates servers[0].url from src/code-gen-process.ts into the HttpClient constructor without escaping, allowing an attacker-controlled OpenAPI spec to inject code that executes when new HttpClient() or new Api() is constructed. This issue is fixed in version 13.12.2.
A code injection vulnerability has been identified in the Swagger-Typescript-Api package, specifically in versions prior to 13.12.2. The issue arises within the Axios HTTP client template, where the 'servers[0].url' from the OpenAPI specification is interpolated into the HttpClient constructor without proper escaping. This flaw allows an attacker to inject malicious code that is executed when the HttpClient or Api instances are created. The vulnerability is triggered by crafting an OpenAPI spec that exploits the unescaped URL, leading to arbitrary code execution in the context of the importing process.
Users can update to Swagger-Typescript-Api version 13.12.2 or later, where this vulnerability has been fixed. The update process involves changing the package version in the project's package.json file and reinstalling the dependencies.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 29, 2026CISA-ADP
Assessed Jul 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/acacode/swagger-typescript-api/commit/306d59acb8ffbb00f953f807b97234b21f51d9de | [email protected] | Source CodeVendor |
| https://github.com/acacode/swagger-typescript-api/pull/1779 | [email protected] | Issue TrackingVendor |
| https://github.com/acacode/swagger-typescript-api/releases/tag/v13.12.2 | [email protected] | Release NotesVendor |
| https://github.com/acacode/swagger-typescript-api/security/advisories/GHSA-38c3-wv3c-v3xj | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1336 | Improper Neutralization of Special Elements Used in a Template Engine | [email protected] |
| CWE-74 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | [email protected] |
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| acacode/swagger-typescript-api | <= 13.12.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 29, 2026 | CVE Modified | CISA-ADP |
| Jul 29, 2026 | New CVE Received | [email protected] |