Is CVE-2026-54666 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-54666 being exploited in the wild.

How severe is CVE-2026-54666?

High severity, with a CVSS score of 8.3, published 29 July 2026.

Which products and versions are affected?

swagger-typescript-api (npm) <= 13.12.1, SEMVER:introduced=0,fixed=13.12.2.

Is there a fix for CVE-2026-54666?

Yes. swagger-typescript-api (npm): upgrade to 13.12.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-54666 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-54666?

Check whether you run swagger-typescript-api (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54666: acacode swagger-typescript-api code injection in generated method bodies

Q: Is there a fix for CVE-2026-54666?

Yes. swagger-typescript-api (npm): upgrade to 13.12.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-54666 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-54666?

Check whether you run swagger-typescript-api (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54666 · Severity: high · CVSS 8.3 · Published 2026-07-29

swagger-typescript-api is a tool used by developers to automatically generate TypeScript code for interacting with web services. A security flaw allows a malicious service definition (OpenAPI spec) to inject hidden, harmful code into the generated files. If a developer uses a compromised service definition, the resulting code could allow an attacker to steal data or take control of the application whenever the affected functions are called.

Technologies: swagger-typescript-api (npm). Vendors: npm.

Quick answers

Is CVE-2026-54666 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-54666 being exploited in the wild.
How severe is CVE-2026-54666?: High severity, with a CVSS score of 8.3, published 29 July 2026.
Which products and versions are affected?: swagger-typescript-api (npm) <= 13.12.1, SEMVER:introduced=0,fixed=13.12.2.
Is there a fix for CVE-2026-54666?: Yes. swagger-typescript-api (npm): upgrade to 13.12.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54666 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-54666?: Check whether you run swagger-typescript-api (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

swagger-typescript-api (npm): upgrade to 13.12.2 or later
```
npm install swagger-typescript-api@13.12.2
```

Technical details

A code injection vulnerability exists in swagger-typescript-api due to improper neutralization of special elements in OpenAPI path keys. The component 'src/schema-routes/schema-routes.ts' passes path keys through 'parseRouteName' to EJS templates without escaping JavaScript template literal interpolation characters. An attacker providing a malicious OpenAPI specification can include '${...}' sequences in path names that remain unescaped in the generated output. When a developer integrates the generated client and calls the affected method, the injected JavaScript executes with the privileges of the application process. This issue is fixed in version 13.12.2.

Affected products

acacode swagger-typescript-api < 13.12.2

Identifiers

CVE-2026-54666
GHSA-w284-33mx-6g9v

Timeline

2026-06-08: patched: Fixes for code injection and SSRF merged in PR #1779
2026-07-29: advisory: CVE-2026-54666 published via NVD and GitHub Advisory Database

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.