# CVE-2026-54660: acacode swagger-typescript-api credential exfiltration via remote $ref resolution

Source: https://junglewise.ai/threats/cve-2026-54660-acacode-swagger-typescript-api-credential-exfiltration-via-remote  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-29. Updated: 2026-07-29  
License: CC BY 4.0 with a link back

CVE-2026-54660 · Severity: high · CVSS 7.4 · Published 2026-07-29

swagger-typescript-api is a tool used by developers to automatically generate code for interacting with web services. A security flaw allows a malicious API specification file to trick the tool into sending the developer's private authentication tokens (such as GitHub or corporate login tokens) to an attacker-controlled server. This could lead to the theft of sensitive credentials used in development or automated build environments.

Technologies: [swagger-typescript-api (npm)](https://junglewise.ai/threats/technologies/swagger-typescript-api). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-54660 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54660 being exploited in the wild.

**How severe is CVE-2026-54660?** High severity, with a CVSS score of 7.4, published 29 July 2026.

**Which products and versions are affected?** swagger-typescript-api (npm) <= 13.12.1, SEMVER:introduced=0,fixed=13.12.2.

**Is there a fix for CVE-2026-54660?** Yes. swagger-typescript-api (npm): upgrade to 13.12.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54660 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-54660?** Check whether you run swagger-typescript-api (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- swagger-typescript-api (npm): upgrade to 13.12.2 or later

  ```sh
  npm install swagger-typescript-api@13.12.2
  ```


## Technical details

The vulnerability exists in the remote schema resolution logic within `src/resolved-swagger-schema.ts`. When the `--authorizationToken` flag is used, the `getRemoteRequestHeaders` function attaches the token to every HTTP request made by `fetchRemoteSchemaDocument`. Because `warmUpRemoteSchemasCache` resolves external `$ref` URLs without performing same-origin checks, an attacker can craft an OpenAPI specification that includes a reference to an external, attacker-controlled domain. When a developer or CI/CD pipeline processes this malicious spec, the bearer token is exfiltrated to the attacker's server. This issue is fixed in version 13.12.2 by enforcing same-origin checks for token forwarding.

## Affected products

- acacode swagger-typescript-api < 13.12.2

## Identifiers

- CVE-2026-54660
- GHSA-h754-fxp7-88wx

## Timeline

- 2026-06-08: patched: Fixed in version 13.12.2
- 2026-07-29: disclosed: CVE-2026-54660 published

## References

- [https://github.com/acacode/swagger-typescript-api/commit/306d59acb8ffbb00f953f807b97234b21f51d9de](https://github.com/acacode/swagger-typescript-api/commit/306d59acb8ffbb00f953f807b97234b21f51d9de)
- [https://github.com/acacode/swagger-typescript-api/pull/1779](https://github.com/acacode/swagger-typescript-api/pull/1779)
- [https://github.com/acacode/swagger-typescript-api/releases/tag/v13.12.2](https://github.com/acacode/swagger-typescript-api/releases/tag/v13.12.2)
- [https://github.com/acacode/swagger-typescript-api/security/advisories/GHSA-h754-fxp7-88wx](https://github.com/acacode/swagger-typescript-api/security/advisories/GHSA-h754-fxp7-88wx)

## Related threats

- [acacode swagger-typescript-api code injection in generated method bodies](https://junglewise.ai/threats/cve-2026-54666-acacode-swagger-typescript-api-code-injection-in-generated-method)
- [acacode swagger-typescript-api code injection in generated clients](https://junglewise.ai/threats/cve-2026-54664-acacode-swagger-typescript-api-code-injection-in-generated)
- [acacode swagger-typescript-api SSRF via remote schema resolution](https://junglewise.ai/threats/cve-2026-54663-acacode-swagger-typescript-api-ssrf-via-remote-schema-resolution)
- [acacode swagger-typescript-api code injection in generated Fetch client](https://junglewise.ai/threats/cve-2026-54662-acacode-swagger-typescript-api-code-injection-in-generated-fetch)
- [acacode swagger-typescript-api code injection in axios-http-client](https://junglewise.ai/threats/cve-2026-54661-acacode-swagger-typescript-api-code-injection-in-axios-http)