# CVE-2026-54664: acacode swagger-typescript-api code injection in generated clients

Source: https://junglewise.ai/threats/cve-2026-54664-acacode-swagger-typescript-api-code-injection-in-generated  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-29. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-54664 · Severity: high · CVSS 8.3 · Published 2026-07-29

swagger-typescript-api is a code generator that creates TypeScript API clients from OpenAPI specifications. A malicious OpenAPI spec can inject arbitrary code into generated TypeScript enum declarations through unescaped string values. This code executes automatically when the generated client is imported, allowing attackers to read files, steal secrets, or run commands with the privileges of the importing process—without any manual instantiation or method calls required.

Technologies: [swagger-typescript-api (npm)](https://junglewise.ai/threats/technologies/swagger-typescript-api). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-54664 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54664 being exploited in the wild.

**How severe is CVE-2026-54664?** High severity, with a CVSS score of 8.3, published 29 July 2026.

**Which products and versions are affected?** swagger-typescript-api (npm) <= 13.12.1, SEMVER:introduced=0,fixed=13.12.2.

**Is there a fix for CVE-2026-54664?** Yes. swagger-typescript-api (npm): upgrade to 13.12.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54664 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-54664?** Check whether you run swagger-typescript-api (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- swagger-typescript-api (npm): upgrade to 13.12.2 or later

  ```sh
  npm install swagger-typescript-api@13.12.2
  ```


## Technical details

The vulnerability is a code-injection / template-engine-injection (CWE-94, CWE-1336) in the Ts.StringValue function (src/configuration.ts:250), which wraps enum values in double quotes with zero escaping: `"${content}"`. When this function processes an attacker-supplied enum value containing a quote character, the string literal closes prematurely, allowing injection of arbitrary TypeScript syntax. An attacker can inject `";}{(async()=>{...})();//` to terminate the enum body, open a bare block, and execute an async IIFE at module load time. The generated code parses cleanly and bundles through esbuild; the IIFE fires on bare `import()` of the generated module, granting the attacker full access to the importing process's file system, environment, and network. Attack requires an OpenAPI spec under attacker control (remote `--url`, third-party spec, multi-tenant platform, or PR-modifiable local file) and a developer or CI runner that generates the client from that spec and imports it. No instantiation, method call, or use of the injected enum value is needed—import alone triggers execution.

## Affected products

- acacode swagger-typescript-api <= 13.12.1

## Identifiers

- CVE-2026-54664
- GHSA-5f94-x226-ccpm

## Timeline

- 2026-07-29: disclosed: GHSA-5f94-x226-ccpm published
- 2026-06-08: patched: Security fixes merged in PR #1779; Ts.StringValue escape hardening and Ref fetch sanitization applied

## References

- [https://github.com/acacode/swagger-typescript-api/security/advisories/GHSA-5f94-x226-ccpm](https://github.com/acacode/swagger-typescript-api/security/advisories/GHSA-5f94-x226-ccpm)
- [https://github.com/acacode/swagger-typescript-api/pull/1779](https://github.com/acacode/swagger-typescript-api/pull/1779)
- [https://github.com/acacode/swagger-typescript-api/commit/306d59acb8ffbb00f953f807b97234b21f51d9de](https://github.com/acacode/swagger-typescript-api/commit/306d59acb8ffbb00f953f807b97234b21f51d9de)
- [https://github.com/acacode/swagger-typescript-api](https://github.com/acacode/swagger-typescript-api)
- [https://github.com/acacode/swagger-typescript-api/releases/tag/v13.12.2](https://github.com/acacode/swagger-typescript-api/releases/tag/v13.12.2)

## Related threats

- [acacode swagger-typescript-api code injection in generated method bodies](https://junglewise.ai/threats/cve-2026-54666-acacode-swagger-typescript-api-code-injection-in-generated-method)
- [acacode swagger-typescript-api SSRF via remote schema resolution](https://junglewise.ai/threats/cve-2026-54663-acacode-swagger-typescript-api-ssrf-via-remote-schema-resolution)
- [acacode swagger-typescript-api code injection in generated Fetch client](https://junglewise.ai/threats/cve-2026-54662-acacode-swagger-typescript-api-code-injection-in-generated-fetch)
- [acacode swagger-typescript-api code injection in axios-http-client](https://junglewise.ai/threats/cve-2026-54661-acacode-swagger-typescript-api-code-injection-in-axios-http)
- [acacode swagger-typescript-api credential exfiltration via remote $ref resolution](https://junglewise.ai/threats/cve-2026-54660-acacode-swagger-typescript-api-credential-exfiltration-via-remote)