CVE-2026-54662: acacode swagger-typescript-api code injection in generated Fetch client

CVE-2026-54662 · Severity: high · CVSS 8.3 · Published 2026-07-29

swagger-typescript-api is a tool used by developers to automatically generate code for interacting with web services based on their technical specifications (OpenAPI). A security flaw allows a malicious specification file to inject hidden, harmful code into the generated files. If a developer uses a compromised specification and then imports the resulting code into their project, the malicious code will automatically execute, potentially allowing an attacker to steal data or take control of the system.

Technologies: swagger-typescript-api (npm). Vendors: npm.

Quick answers

Is CVE-2026-54662 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-54662 being exploited in the wild.
How severe is CVE-2026-54662?
High severity, with a CVSS score of 8.3, published 29 July 2026.
Which products and versions are affected?
swagger-typescript-api (npm) <= 13.12.1, SEMVER:introduced=0,fixed=13.12.2.
Is there a fix for CVE-2026-54662?
Yes. swagger-typescript-api (npm): upgrade to 13.12.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54662 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-54662?
Check whether you run swagger-typescript-api (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • swagger-typescript-api (npm): upgrade to 13.12.2 or later
    npm install swagger-typescript-api@13.12.2

Technical details

A code injection vulnerability exists in swagger-typescript-api due to improper neutralization of the 'servers[0].url' field from OpenAPI specifications. The 'src/code-gen-process.ts' component copies this URL into 'apiConfig.baseUrl', which is then interpolated without escaping into the 'fetch-http-client.ejs' template. An attacker can provide a malicious OpenAPI spec containing a URL that breaks out of the string literal in the generated TypeScript class. This allows the injection of static field initializers or IIFEs that execute at module load time when the generated client is imported. The vulnerability is fixed in version 13.12.2 by properly escaping the base URL and other untrusted inputs like enum values and path strings.

Affected products

  • acacode swagger-typescript-api < 13.12.2

Identifiers

  • CVE-2026-54662
  • GHSA-hqj5-cw9f-rx67

Timeline

  • 2026-06-08: patched: Fixes merged in PR #1779 and released in v13.12.2
  • 2026-07-29: disclosed: CVE-2026-54662 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.