Junglewise Threat Intelligence

CVE-2026-54664: acacode swagger-typescript-api code injection in generated clients

CVE-2026-54664 · Severity: high · CVSS 8.3 · Published 2026-07-29

Technologies: Acacode Swagger-Typescript-Api. Vendors: npm.

Executive brief

swagger-typescript-api is a code generator that creates TypeScript API clients from OpenAPI specifications. A malicious OpenAPI spec can inject arbitrary code into generated TypeScript enum declarations through unescaped string values. This code executes automatically when the generated client is imported, allowing attackers to read files, steal secrets, or run commands with the privileges of the importing process—without any manual instantiation or method calls required.

Technical details

The vulnerability is a code-injection / template-engine-injection (CWE-94, CWE-1336) in the Ts.StringValue function (src/configuration.ts:250), which wraps enum values in double quotes with zero escaping: `"${content}"`. When this function processes an attacker-supplied enum value containing a quote character, the string literal closes prematurely, allowing injection of arbitrary TypeScript syntax. An attacker can inject `";}{(async()=>{...})();//` to terminate the enum body, open a bare block, and execute an async IIFE at module load time. The generated code parses cleanly and bundles through esbuild; the IIFE fires on bare `import()` of the generated module, granting the attacker full access to the importing process's file system, environment, and network. Attack requires an OpenAPI spec under attacker control (remote `--url`, third-party spec, multi-tenant platform, or PR-modifiable local file) and a developer or CI runner that generates the client from that spec and imports it. No instantiation, method call, or use of the injected enum value is needed—import alone triggers execution.

Affected products

  • acacode swagger-typescript-api <= 13.12.1

Timeline

  • 2026-07-29: disclosed: GHSA-5f94-x226-ccpm published
  • 2026-06-08: patched: Security fixes merged in PR #1779; Ts.StringValue escape hardening and Ref fetch sanitization applied

References

Related threats