CVE-2026-54666 in swagger-typescript-api
Summary
by MITRE • 07/29/2026
swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, src/schema-routes/schema-routes.ts passes OpenAPI path keys through parseRouteName to templates/default/procedure-call.ejs and templates/modular/procedure-call.ejs without escaping JavaScript template literal interpolation, allowing an attacker-controlled path containing ${...} to execute when the generated method is called. This issue is fixed in version 13.12.2.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/29/2026
The swagger-typescript-api tool serves as a critical bridge between OpenAPI specifications and client-side implementations, automatically generating TypeScript API clients for various HTTP libraries including Fetch and Axios. This automation significantly streamlines development workflows but introduces potential security vulnerabilities when handling untrusted input from specification files. The vulnerability resides in the schema-routes.ts module where path keys extracted from OpenAPI specifications are processed through the parseRouteName function without proper sanitization before being passed to JavaScript template literal contexts.
The technical flaw manifests in the improper handling of user-controlled data within template interpolation scenarios. When OpenAPI specifications contain path parameters or route names that include JavaScript template literal syntax such as ${...}, these constructs bypass normal input validation mechanisms and are directly embedded into generated code templates. The affected files procedure-call.ejs in both default and modular template directories receive these unescaped path keys, creating a scenario where attacker-controlled content can execute arbitrary JavaScript code during client-side API method invocation. This represents a classic server-side template injection vulnerability that can be exploited through malicious OpenAPI specification inputs.
The operational impact of this vulnerability extends beyond simple code execution, as it allows attackers to manipulate the generated client behavior in potentially destructive ways. When an application consumes API specifications from untrusted sources, such as third-party services or user uploads, the attacker could craft malicious path definitions that when processed by swagger-typescript-api would result in arbitrary code execution within the context of any application using the generated client. This vulnerability affects not just direct consumers but also downstream applications that rely on these automatically generated clients for API communication, creating a propagation vector for more complex attack chains.
The fix implemented in version 13.12.2 addresses this issue by ensuring proper escaping of path keys before they are passed to template literal contexts. This aligns with established security practices for preventing injection vulnerabilities and follows the principle of least privilege in input handling. Organizations should immediately upgrade to version 13.12.2 or later to mitigate this risk, particularly those that process OpenAPI specifications from external sources or allow user-provided specification files. The vulnerability can be mapped to CWE-94 (Improper Control of Generation of Code) and potentially CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component), with exploitation patterns aligning with ATT&CK techniques involving code injection and execution within application contexts.
Security teams should implement monitoring for any instances where OpenAPI specifications are processed from untrusted sources, establishing input validation policies that reject or sanitize path names containing template literal syntax. Additionally, organizations using this tool should conduct security reviews of their API client generation processes and consider implementing automated scanning for potentially malicious specification content. The vulnerability highlights the importance of proper input sanitization in code generation tools and demonstrates how seemingly benign automation can introduce critical security risks when not properly secured against user-controlled inputs.