CVE-2026-54662CWE-1336CWE-74CWE-94code-injection

CVE-2026-54662

High · published July 29, 2026

CVSS v3.1
8.3
EPSS
0%
Percentile
40.2
In the wild
Unconfirmed
What it is

swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/code-gen-process.ts createApiConfig copies servers[0].url into apiConfig.baseUrl, and templates/base/http-clients/fetch-http-client.ejs interpolates apiConfig.baseUrl into the generated HttpClient baseUrl field without escaping, allowing an attacker-controlled OpenAPI spec to inject TypeScript static field code that executes when the generated fetch client module is imported. This issue is fixed in version 13.12.2.

The record
Technical detail
CVSS v3.1
8.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00477 · 40.2th percentile
Weaknesses
CWE-1336 · Improper Neutralization of Special Elements Used in a Template Engine; CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'); CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2026-07-29T19:16Z
References (5)
https://github.com/acacode/swagger-typescript-api/commit/306d59acb8ffbb00f953f807b97234b21f51d9de · [email protected]https://github.com/acacode/swagger-typescript-api/pull/1779 · [email protected]https://github.com/acacode/swagger-typescript-api/releases/tag/v13.12.2 · [email protected]https://github.com/acacode/swagger-typescript-api/security/advisories/GHSA-hqj5-cw9f-rx67 · [email protected]https://github.com/acacode/swagger-typescript-api/security/advisories/GHSA-hqj5-cw9f-rx67 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 29 JUL 14:26Z
    swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in fetch http-client template
    cvelistv5