CVE-2026-54662 Details
Description
swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/code-gen-process.ts createApiConfig copies servers[0].url into apiConfig.baseUrl, and templates/base/http-clients/fetch-http-client.ejs interpolates apiConfig.baseUrl into the generated HttpClient baseUrl field without escaping, allowing an attacker-controlled OpenAPI spec to inject TypeScript static field code that executes when the generated fetch client module is imported. This issue is fixed in version 13.12.2.
A code injection vulnerability has been identified in the Swagger TypeScript API tool, specifically in versions prior to 13.12.2. This tool generates API clients for Fetch or Axios based on OpenAPI specifications. The vulnerability arises because the 'servers[0].url' from the OpenAPI spec is directly copied into the 'apiConfig.baseUrl' without proper escaping. This unescaped URL can inject malicious TypeScript code that executes when the generated Fetch client module is imported. The issue is particularly severe because it allows for arbitrary code execution in the context of the importing process.
Users can update to Swagger TypeScript API version 13.12.2 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 29, 2026CISA-ADP
Assessed Jul 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/acacode/swagger-typescript-api/security/advisories/GHSA-hqj5-cw9f-rx67 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/acacode/swagger-typescript-api/commit/306d59acb8ffbb00f953f807b97234b21f51d9de | [email protected] | Source CodeVendor |
| https://github.com/acacode/swagger-typescript-api/pull/1779 | [email protected] | Issue TrackingVendor |
| https://github.com/acacode/swagger-typescript-api/releases/tag/v13.12.2 | [email protected] | Release NotesVendor |
| https://github.com/acacode/swagger-typescript-api/security/advisories/GHSA-hqj5-cw9f-rx67 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1336 | Improper Neutralization of Special Elements Used in a Template Engine | [email protected] |
| CWE-74 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | [email protected] |
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| acacode swagger-typescript-api | <= 13.12.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 29, 2026 | CVE Modified | CISA-ADP |
| Jul 29, 2026 | New CVE Received | [email protected] |