# CVE-2026-54666: acacode swagger-typescript-api code injection in generated method bodies

Source: https://junglewise.ai/threats/cve-2026-54666-acacode-swagger-typescript-api-code-injection-in-generated-method  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-29. Updated: 2026-07-29  
License: CC BY 4.0 with a link back

CVE-2026-54666 · Severity: high · CVSS 8.3 · Published 2026-07-29

swagger-typescript-api is a tool used by developers to automatically generate TypeScript code for interacting with web services. A security flaw allows a malicious service definition (OpenAPI spec) to inject hidden, harmful code into the generated files. If a developer uses a compromised service definition, the resulting code could allow an attacker to steal data or take control of the application whenever the affected functions are called.

Technologies: [swagger-typescript-api (npm)](https://junglewise.ai/threats/technologies/swagger-typescript-api). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-54666 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54666 being exploited in the wild.

**How severe is CVE-2026-54666?** High severity, with a CVSS score of 8.3, published 29 July 2026.

**Which products and versions are affected?** swagger-typescript-api (npm) <= 13.12.1, SEMVER:introduced=0,fixed=13.12.2.

**Is there a fix for CVE-2026-54666?** Yes. swagger-typescript-api (npm): upgrade to 13.12.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54666 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-54666?** Check whether you run swagger-typescript-api (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- swagger-typescript-api (npm): upgrade to 13.12.2 or later

  ```sh
  npm install swagger-typescript-api@13.12.2
  ```


## Technical details

A code injection vulnerability exists in swagger-typescript-api due to improper neutralization of special elements in OpenAPI path keys. The component 'src/schema-routes/schema-routes.ts' passes path keys through 'parseRouteName' to EJS templates without escaping JavaScript template literal interpolation characters. An attacker providing a malicious OpenAPI specification can include '${...}' sequences in path names that remain unescaped in the generated output. When a developer integrates the generated client and calls the affected method, the injected JavaScript executes with the privileges of the application process. This issue is fixed in version 13.12.2.

## Affected products

- acacode swagger-typescript-api < 13.12.2

## Identifiers

- CVE-2026-54666
- GHSA-w284-33mx-6g9v

## Timeline

- 2026-06-08: patched: Fixes for code injection and SSRF merged in PR #1779
- 2026-07-29: advisory: CVE-2026-54666 published via NVD and GitHub Advisory Database

## References

- [https://github.com/acacode/swagger-typescript-api/commit/306d59acb8ffbb00f953f807b97234b21f51d9de](https://github.com/acacode/swagger-typescript-api/commit/306d59acb8ffbb00f953f807b97234b21f51d9de)
- [https://github.com/acacode/swagger-typescript-api/pull/1779](https://github.com/acacode/swagger-typescript-api/pull/1779)
- [https://github.com/acacode/swagger-typescript-api/releases/tag/v13.12.2](https://github.com/acacode/swagger-typescript-api/releases/tag/v13.12.2)
- [https://github.com/acacode/swagger-typescript-api/security/advisories/GHSA-w284-33mx-6g9v](https://github.com/acacode/swagger-typescript-api/security/advisories/GHSA-w284-33mx-6g9v)

## Related threats

- [acacode swagger-typescript-api code injection in generated clients](https://junglewise.ai/threats/cve-2026-54664-acacode-swagger-typescript-api-code-injection-in-generated)
- [acacode swagger-typescript-api SSRF via remote schema resolution](https://junglewise.ai/threats/cve-2026-54663-acacode-swagger-typescript-api-ssrf-via-remote-schema-resolution)
- [acacode swagger-typescript-api code injection in generated Fetch client](https://junglewise.ai/threats/cve-2026-54662-acacode-swagger-typescript-api-code-injection-in-generated-fetch)
- [acacode swagger-typescript-api code injection in axios-http-client](https://junglewise.ai/threats/cve-2026-54661-acacode-swagger-typescript-api-code-injection-in-axios-http)
- [acacode swagger-typescript-api credential exfiltration via remote $ref resolution](https://junglewise.ai/threats/cve-2026-54660-acacode-swagger-typescript-api-credential-exfiltration-via-remote)