swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in axios http-client template
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- High
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-1336.
Summary
swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, templates/base/http-clients/axios-http-client.ejs interpolates servers[0].url from src/code-gen-process.ts into the HttpClient constructor without escaping, allowing an attacker-controlled OpenAPI spec to inject code that executes when new HttpClient() or new Api() is constructed. This issue is fixed in version 13.12.2.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| acacode | swagger-typescript-api | before 13.12.2 | 13.12.2 | Patch available | CNA |
| — | swagger-typescript-api (npm) | before 13.12.2 | 13.12.2 | Patch available | GHSA-38c3-wv3c-v3xj |
- swagger-typescript-api Vendoracacode Affected before 13.12.2 Fixed in 13.12.2 Patch available CNA
- swagger-typescript-api (npm) Vendor— Affected before 13.12.2 Fixed in 13.12.2 Patch available GHSA-38c3-wv3c-v3xj
Remediation
- Fix · CNA swagger-typescript-api (acacode) Fixed in 13.12.2
- Fix · GHSA-38c3-wv3c-v3xj swagger-typescript-api (npm) Fixed in 13.12.2 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-54661
- 2026-10-03 Alias added: GHSA-38c3-wv3c-v3xj
References
Other 5
- https://github.com/acacode/swagger-typescript-api/security/advisories/GHSA-38c3-wv3c-v3xj
- https://github.com/acacode/swagger-typescript-api/pull/1779
- https://github.com/acacode/swagger-typescript-api/commit/306d59acb8ffbb00f953f807b97234b21f51d9de
- https://github.com/acacode/swagger-typescript-api/releases/tag/v13.12.2
- https://github.com/acacode/swagger-typescript-api
More acacode vulnerabilities
- TI-2026-39492 swagger-typescript-api vulnerable to code injection via unescaped OpenAPI path strings in generated method bodies CVSS 3.1HIGH 8.3
- TI-2026-39490 swagger-typescript-api vulnerable to code injection via unescaped enum string values CVSS 3.1HIGH 8.3
- TI-2026-39488 swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in fetch http-client template CVSS 3.1HIGH 8.3
- TI-2026-39486 swagger-typescript-api vulnerable to authorization-token exfiltration via spec `$ref` CVSS 3.1HIGH 7.4
- TI-2026-39489 swagger-typescript-api vulnerable to Server-Side Request Forgery via spec `$ref` CVSS 3.1MEDIUM 6.1
Sources
- CVE-2026-54661 · CVE Program
- CVE-2026-54661 · NVD
- FIRST EPSS
- GHSA-38c3-wv3c-v3xj · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences