CVE-2026-54661: acacode swagger-typescript-api code injection in axios-http-client

CVE-2026-54661 · Severity: high · CVSS 8.3 · Published 2026-07-29

swagger-typescript-api is a code generator that creates TypeScript API clients from OpenAPI specifications. A vulnerability in its axios client template allows attackers who control the OpenAPI spec to inject arbitrary code that executes when the generated client is instantiated. This leads to remote code execution with the privileges of the importing application, potentially allowing data exfiltration, malware installation, or system compromise.

Technologies: swagger-typescript-api (npm). Vendors: npm.

Quick answers

Is CVE-2026-54661 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-54661 being exploited in the wild.
How severe is CVE-2026-54661?
High severity, with a CVSS score of 8.3, published 29 July 2026.
Which products and versions are affected?
swagger-typescript-api (npm) <= 13.12.1, SEMVER:introduced=0,fixed=13.12.2.
Is there a fix for CVE-2026-54661?
Yes. swagger-typescript-api (npm): upgrade to 13.12.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54661 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-54661?
Check whether you run swagger-typescript-api (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • swagger-typescript-api (npm): upgrade to 13.12.2 or later
    npm install swagger-typescript-api@13.12.2

Technical details

The vulnerability is a template-engine injection (CWE-1336) in the axios http-client code generation path. The root cause is in templates/base/http-clients/axios-http-client.ejs:71, which uses raw (unescaped) Eta interpolation (&lt;%~ %&gt;) to insert apiConfig.baseUrl into a JavaScript object literal argument to axios.create({...}) inside the HttpClient constructor body. An attacker-controlled servers[0].url value like `"URL", [(IIFE)()]: 0, dummy: "` closes the baseURL string literal and injects a computed property key containing an IIFE that executes eagerly when the object is constructed—that is, every time new HttpClient() runs. The trailing dummy property reopens a string to maintain syntactic validity. Attack surface includes any developer or pipeline running swagger-typescript-api with --http-client axios against third-party, vendor, or attacker-hosted OpenAPI specs. The documented usage pattern of `const api = new Api()` at module top level means the payload fires at module import time. Patches applied in PR #1779 escape apiConfig.baseUrl and other untrusted spec fields before templating, block SSRF in remote $ref resolution, and validate redirect targets.

Affected products

  • acacode swagger-typescript-api <= 13.12.1

Identifiers

  • CVE-2026-54661
  • GHSA-38c3-wv3c-v3xj

Timeline

  • 2026-07-29: disclosed
  • 2026-06-08: patched: Security fix merged in PR #1779 (commit 306d59ac)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.