Junglewise Threat Intelligence

CVE-2026-54666: acacode swagger-typescript-api code injection in generated method bodies

CVE-2026-54666 · Severity: high · CVSS 8.3 · Published 2026-07-29

Technologies: swagger-typescript-api (npm). Vendors: npm.

Executive brief

swagger-typescript-api is a tool used by developers to automatically generate TypeScript code for interacting with web services. A security flaw allows a malicious service definition (OpenAPI spec) to inject hidden, harmful code into the generated files. If a developer uses a compromised service definition, the resulting code could allow an attacker to steal data or take control of the application whenever the affected functions are called.

Technical details

A code injection vulnerability exists in swagger-typescript-api due to improper neutralization of special elements in OpenAPI path keys. The component 'src/schema-routes/schema-routes.ts' passes path keys through 'parseRouteName' to EJS templates without escaping JavaScript template literal interpolation characters. An attacker providing a malicious OpenAPI specification can include '${...}' sequences in path names that remain unescaped in the generated output. When a developer integrates the generated client and calls the affected method, the injected JavaScript executes with the privileges of the application process. This issue is fixed in version 13.12.2.

Affected products

  • acacode swagger-typescript-api < 13.12.2

Timeline

  • 2026-06-08: patched: Fixes for code injection and SSRF merged in PR #1779
  • 2026-07-29: advisory: CVE-2026-54666 published via NVD and GitHub Advisory Database

References

Related threats