CVE-2026-54664 in swagger-typescript-api
Summary
by MITRE • 07/29/2026
swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, src/schema-parser/base-schema-parsers/enum.ts passes components.schemas.*.enum[i] values to Ts.StringValue in src/configuration.ts without escaping before templates/base/enum-data-contract.ejs renders TypeScript enum declarations, allowing an attacker-controlled OpenAPI spec to inject code that executes when the generated module is imported. This issue is fixed in version 13.12.2.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/29/2026
This vulnerability exists within the swagger-typescript-api toolchain which generates TypeScript client code for API consumption using fetch or axios libraries. The flaw resides in the schema parsing mechanism where enum values from OpenAPI specifications are directly processed without proper sanitization before template rendering. The specific issue occurs in the base-schema-parsers/enum.ts file where component schema enum values are passed to Ts.StringValue function without adequate escaping mechanisms. This creates a code injection vector that can be exploited through maliciously crafted OpenAPI specifications.
The technical execution path involves multiple layers of processing where attacker-controlled data flows from the OpenAPI specification components.schemas.*.enum[i] properties through the enum.ts parser directly into the TypeScript string value generation process. When the template engine base/enum-data-contract.ejs renders the enum declarations, the unsanitized values are incorporated into the generated TypeScript code without proper escaping or validation. This represents a classic server-side template injection vulnerability where user-provided data is rendered within executable code contexts.
The operational impact of this vulnerability extends beyond simple code execution as it allows attackers to inject arbitrary JavaScript/TypeScript code that will execute whenever the generated client module is imported or used in any application context. This creates a persistent threat vector that can affect any system utilizing the generated API clients, potentially leading to data exfiltration, remote code execution, or other malicious activities depending on how the generated modules are employed. The vulnerability affects all versions prior to 13.12.2, meaning any systems using older versions of this tool are exposed to this risk.
The fix implemented in version 13.12.2 addresses this by introducing proper escaping mechanisms before enum values are passed to template rendering processes. This aligns with established security practices for preventing injection attacks and follows the principle of least privilege where user-provided data must be properly sanitized before being incorporated into executable code contexts. Organizations should immediately upgrade to version 13.12.2 or later to mitigate this risk, and security teams should review any existing generated API clients for potential compromise. This vulnerability maps to CWE-94 (Improper Control of Generation of Code) and could be leveraged in ATT&CK frameworks under the T1059.007 technique for script injection, potentially leading to broader system compromise through the execution of malicious code within legitimate development toolchains.
The root cause demonstrates a failure in input validation and sanitization within the OpenAPI specification processing pipeline, highlighting the importance of treating external schema data as untrusted and properly escaping all values before template rendering. This vulnerability underscores the critical need for security considerations in development tooling, as tools that process external specifications can become attack vectors themselves when proper sanitization measures are not implemented. Organizations should implement automated checks to ensure their development toolchains remain updated with security patches and conduct regular audits of third-party dependencies to prevent similar issues from affecting their software supply chain integrity.