PT-2026-50683 · Npm · Swagger-Typescript-Api

CVE-2026-54666 · Published 2026-06-18 · Updated 2026-07-29

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions swagger-typescript-api versions prior to 13.12.2

Description swagger-typescript-api fails to properly escape OpenAPI path keys when passing them through the parseRouteName() function to the procedure-call.ejs templates. This allows an attacker who controls the OpenAPI specification to inject malicious JavaScript expressions using ${...} syntax into the generated API client. When a developer calls the affected generated method, the injected code is executed with the full privileges of the process, potentially leading to unauthorized file access, data exfiltration, or remote code execution.

Recommendations Update swagger-typescript-api to version 13.12.2 or later.

Exploit

Fix

Special Elements Injection

Code Injection

Weakness Enumeration

CWE-74

CWE-94

CWE-1336

Related Identifiers

CVE-2026-54666

GHSA-W284-33MX-6G9V

Affected Products

Swagger-Typescript-Api

References · 10

• 🔥 https://github.com/acacode/swagger-typescript-api/security/advisories/GHSA-w284-33mx-6g9v · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54666.json · Exploit
• https://osv.dev/vulnerability/GHSA-w284-33mx-6g9v · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-54666 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-54666 · Security Note
• https://github.com/acacode/swagger-typescript-api/releases/tag/v13.12.2 · Note
• https://github.com/acacode/swagger-typescript-api/commit/306d59acb8ffbb00f953f807b97234b21f51d9de · Note
• https://github.com/acacode/swagger-typescript-api · Note
• https://github.com/acacode/swagger-typescript-api/pull/1779 · Note
• https://twitter.com/TheGr1ffyn/status/2067532565079351570 · Twitter Post