CVE-2026-54661

Name of the Vulnerable Software and Affected Versions swagger-typescript-api versions prior to 13.12.2

Description An issue exists where the software interpolates the servers[0].url value from an OpenAPI specification into the HttpClient constructor of the generated axios client without proper escaping. This occurs within the templates/base/http-clients/axios-http-client.ejs file. An attacker providing a malicious OpenAPI specification can use a specially crafted URL containing a double quote to close the string literal and inject a computed property key containing an Immediately Invoked Function Expression (IIFE). This injected code executes with the privileges of the importing process whenever new HttpClient() or new Api() is instantiated. This can lead to arbitrary code execution, allowing an attacker to read sensitive files, exfiltrate secrets, or spawn child processes.

Recommendations Update swagger-typescript-api to version 13.12.2 or later.