CVE-2026-54662 in swagger-typescript-api
Summary
by MITRE • 07/29/2026
swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/code-gen-process.ts createApiConfig copies servers[0].url into apiConfig.baseUrl, and templates/base/http-clients/fetch-http-client.ejs interpolates apiConfig.baseUrl into the generated HttpClient baseUrl field without escaping, allowing an attacker-controlled OpenAPI spec to inject TypeScript static field code that executes when the generated fetch client module is imported. This issue is fixed in version 13.12.2.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/29/2026
This vulnerability exists within the swagger-typescript-api toolchain which generatestypescript clients for http communication from openapi specifications. The flaw manifests in the code generation process where the createApiConfig function in src/code-gen-process.ts directly copies the first server URL from the OpenAPI specification into the apiConfig.baseUrl property without proper sanitization or escaping. When templates/base/http-clients/fetch-http-client.ejs renders this configuration, it interpolates the unescaped apiConfig.baseUrl value directly into the generated HttpClient's baseUrl field, creating a code injection vector that allows attackers to inject arbitrary TypeScript code.
The technical execution of this vulnerability relies on the fact that OpenAPI specifications are typically treated as trusted inputs during code generation, but in this case the tool fails to properly validate or sanitize server URL values. When an attacker controls the OpenAPI specification and provides a malicious server URL containing script injection payloads, the interpolation process in the ejs template effectively executes this injected code within the generated client module context. This represents a classic server-side template injection vulnerability that occurs during static code generation rather than runtime execution.
The operational impact of this vulnerability is significant as it allows remote code execution in applications that use the generated fetch clients. Any application consuming an OpenAPI specification from an untrusted source could be compromised when the swagger-typescript-api tool processes that specification, leading to arbitrary code execution within the context where the generated client is imported and executed. This attack vector is particularly dangerous because it can be exploited through dependency chains where vulnerable tools process specifications from external sources.
This vulnerability maps to CWE-94 (Improper Control of Generation of Code) and CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component). The ATT&CK framework would categorize this under T1059.006 (Command and Scripting Interpreter: JavaScript) as it enables execution of arbitrary javascript code through template injection. The fix implemented in version 13.12.2 addresses this by ensuring proper escaping or sanitization of the server URL values before they are interpolated into the generated code, preventing malicious payloads from being executed during client module import.
Organizations using swagger-typescript-api should immediately upgrade to version 13.12.2 or later to mitigate this risk. Security practices should include validating and sanitizing all OpenAPI specifications from untrusted sources before processing them through code generation tools, implementing proper input validation at the specification parsing level, and monitoring for unexpected code injection patterns in generated client modules. The vulnerability demonstrates the critical importance of treating all external inputs as potentially malicious during static code generation processes where interpolated values can result in executable code execution.