PT-2026-50680 · Npm · Swagger-Typescript-Api
CVE-2026-54662
·
Published
2026-06-18
·
Updated
2026-07-29
CVSS v3.1
8.3
High
| Vector | AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
swagger-typescript-api versions prior to 13.12.2
Description
An issue exists where the software fails to escape the
servers[0].url value from an OpenAPI specification when generating a fetch-based HttpClient. In the createApiConfig function within src/code-gen-process.ts, the baseUrl variable is copied without sanitization and subsequently interpolated into the templates/base/http-clients/fetch-http-client.ejs template using raw interpolation. This allows an attacker who controls the OpenAPI specification to inject TypeScript static field code. Because TypeScript evaluates static field initializers at class definition time, the injected code executes automatically when the generated module is imported, requiring no further interaction such as class instantiation or method calls. This can lead to arbitrary code execution with the full privileges of the importing process.Recommendations
Update swagger-typescript-api to version 13.12.2 or later.
Exploit
Fix
Special Elements Injection
Code Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Swagger-Typescript-Api