CVE-2026-54664 Details
Description
swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, src/schema-parser/base-schema-parsers/enum.ts passes components.schemas.*.enum[i] values to Ts.StringValue in src/configuration.ts without escaping before templates/base/enum-data-contract.ejs renders TypeScript enum declarations, allowing an attacker-controlled OpenAPI spec to inject code that executes when the generated module is imported. This issue is fixed in version 13.12.2.
A code injection vulnerability has been identified in Swagger TypeScript API versions prior to 13.12.2. The issue arises because the application interpolates untrusted enum values from the OpenAPI specification into generated TypeScript enum declarations without proper escaping. This flaw allows an attacker to inject executable JavaScript that is executed when the generated module is imported. The vulnerability can be exploited by manipulating the OpenAPI spec to include malicious enum values, which are then processed by the Swagger TypeScript API generator.
Users can upgrade to Swagger TypeScript API version 13.12.2 or later, where this vulnerability has been fixed. The update ensures that enum values are properly escaped before being interpolated into TypeScript code, preventing code injection.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 29, 2026CISA-ADP
Assessed Jul 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/acacode/swagger-typescript-api/commit/306d59acb8ffbb00f953f807b97234b21f51d9de | [email protected] | Source CodeVendor |
| https://github.com/acacode/swagger-typescript-api/pull/1779 | [email protected] | Issue TrackingVendor |
| https://github.com/acacode/swagger-typescript-api/releases/tag/v13.12.2 | [email protected] | Release NotesVendor |
| https://github.com/acacode/swagger-typescript-api/security/advisories/GHSA-5f94-x226-ccpm | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1336 | Improper Neutralization of Special Elements Used in a Template Engine | [email protected] |
| CWE-74 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | [email protected] |
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| acacode swagger-typescript-api | <= 13.12.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 30, 2026 | CVE Modified | CISA-ADP |
| Jul 29, 2026 | New CVE Received | [email protected] |