acacode swagger-typescript-api up to 13.12.1 Code Generation fetch-http-client.ejs createApiConfig injection

Summaryinfo

A vulnerability was found in acacode swagger-typescript-api up to 13.12.1. It has been rated as critical. The affected element is the function createApiConfig of the file src/code-gen-process.ts/templates/base/http-clients/fetch-http-client.ejs of the component Code Generation. This manipulation causes injection. This vulnerability is handled as CVE-2026-54662. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability was found in acacode swagger-typescript-api up to 13.12.1. It has been declared as critical. Affected by this vulnerability is the function createApiConfig of the file src/code-gen-process.ts/templates/base/http-clients/fetch-http-client.ejs of the component Code Generation. The manipulation with an unknown input leads to a injection vulnerability. The CWE definition for the vulnerability is CWE-74. The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/code-gen-process.ts createApiConfig copies servers[0].url into apiConfig.baseUrl, and templates/base/http-clients/fetch-http-client.ejs interpolates apiConfig.baseUrl into the generated HttpClient baseUrl field without escaping, allowing an attacker-controlled OpenAPI spec to inject TypeScript static field code that executes when the generated fetch client module is imported. This issue is fixed in version 13.12.2.

The advisory is shared at github.com. This vulnerability is known as CVE-2026-54662 since 06/15/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1055 for this issue.

Upgrading to version 13.12.2 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Automation Software

Vendor

• acacode

Name

• swagger-typescript-api

Version

• 13.12.0
• 13.12.1

Website

• Product: https://github.com/acacode/swagger-typescript-api/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion