CVE-2026-54661 in swagger-typescript-api
Summary
by MITRE • 07/29/2026
swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, templates/base/http-clients/axios-http-client.ejs interpolates servers[0].url from src/code-gen-process.ts into the HttpClient constructor without escaping, allowing an attacker-controlled OpenAPI spec to inject code that executes when new HttpClient() or new Api() is constructed. This issue is fixed in version 13.12.2.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/29/2026
The swagger-typescript-api tool serves as a critical bridge between OpenAPI specifications and client-side implementation code generation for web applications. This utility automates the creation of TypeScript clients that can interact with RESTful APIs, supporting both Fetch and Axios HTTP clients through template-based code generation. The vulnerability exists within the axios-http-client.ejs template file which processes server URL information from OpenAPI specifications during the code generation phase. When developers utilize this tool to generate client code from potentially untrusted OpenAPI documents, the system fails to properly sanitize or escape user-controlled input before incorporating it into executable JavaScript code.
The technical flaw stems from improper input validation and output encoding within the code generation pipeline. Specifically, the src/code-gen-process.ts file directly interpolates servers[0].url without implementing any form of escaping or sanitization mechanisms. This creates a classic server-side template injection vulnerability where attacker-controlled data flows directly into executable JavaScript code within the generated client library. When the generated HttpClient constructor executes, any malicious code embedded within the URL parameter gets interpreted and executed as part of the JavaScript runtime environment. The vulnerability is particularly dangerous because it occurs during the build process rather than at runtime, meaning that even legitimate developers could inadvertently execute malicious code if they use an OpenAPI specification from an untrusted source.
The operational impact of this vulnerability extends beyond simple code injection to potentially compromise entire development environments and production systems. An attacker who can influence or control an OpenAPI specification used in the generation process could inject arbitrary JavaScript code that executes whenever new HttpClient() or new Api() objects are instantiated. This could lead to data exfiltration, command execution, or manipulation of the client-side application behavior. The vulnerability affects any developer environment using swagger-typescript-api versions prior to 13.12.2 and represents a significant risk in continuous integration pipelines where automated code generation processes might consume untrusted specifications from external sources.
Security practitioners should note that this vulnerability aligns with CWE-94 (Improper Control of Generation of Code) and CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component). The issue also maps to ATT&CK technique T1059.007 (Command and Scripting Interpreter: JavaScript) as it enables arbitrary code execution through JavaScript injection. Organizations should immediately upgrade to version 13.12.2 or later to resolve this vulnerability. Additional mitigations include implementing strict input validation policies for OpenAPI specifications, using sandboxed environments for code generation processes, and establishing trusted sources for specification files. The fix implemented in version 13.12.2 addresses the root cause by properly escaping user-controlled data before interpolation into generated JavaScript code, ensuring that malicious payloads cannot be executed during client library instantiation.