Junglewise Threat Intelligence

CVE-2026-54662: acacode swagger-typescript-api code injection in generated Fetch client

CVE-2026-54662 · Severity: high · CVSS 8.3 · Published 2026-07-29

Technologies: swagger-typescript-api (npm). Vendors: npm.

Executive brief

swagger-typescript-api is a tool used by developers to automatically generate code for interacting with web services based on their technical specifications (OpenAPI). A security flaw allows a malicious specification file to inject hidden, harmful code into the generated files. If a developer uses a compromised specification and then imports the resulting code into their project, the malicious code will automatically execute, potentially allowing an attacker to steal data or take control of the system.

Technical details

A code injection vulnerability exists in swagger-typescript-api due to improper neutralization of the 'servers[0].url' field from OpenAPI specifications. The 'src/code-gen-process.ts' component copies this URL into 'apiConfig.baseUrl', which is then interpolated without escaping into the 'fetch-http-client.ejs' template. An attacker can provide a malicious OpenAPI spec containing a URL that breaks out of the string literal in the generated TypeScript class. This allows the injection of static field initializers or IIFEs that execute at module load time when the generated client is imported. The vulnerability is fixed in version 13.12.2 by properly escaping the base URL and other untrusted inputs like enum values and path strings.

Affected products

  • acacode swagger-typescript-api < 13.12.2

Timeline

  • 2026-06-08: patched: Fixes merged in PR #1779 and released in v13.12.2
  • 2026-07-29: disclosed: CVE-2026-54662 published

References

Related threats