swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in fetch http-client template
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- High
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-1336.
Summary
swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/code-gen-process.ts createApiConfig copies servers[0].url into apiConfig.baseUrl, and templates/base/http-clients/fetch-http-client.ejs interpolates apiConfig.baseUrl into the generated HttpClient baseUrl field without escaping, allowing an attacker-controlled OpenAPI spec to inject TypeScript static field code that executes when the generated fetch client module is imported. This issue is fixed in version 13.12.2.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| acacode | swagger-typescript-api | before 13.12.2 | 13.12.2 | Patch available | CNA |
| — | swagger-typescript-api (npm) | before 13.12.2 | 13.12.2 | Patch available | GHSA-hqj5-cw9f-rx67 |
- swagger-typescript-api Vendoracacode Affected before 13.12.2 Fixed in 13.12.2 Patch available CNA
- swagger-typescript-api (npm) Vendor— Affected before 13.12.2 Fixed in 13.12.2 Patch available GHSA-hqj5-cw9f-rx67
Remediation
- Fix · CNA swagger-typescript-api (acacode) Fixed in 13.12.2
- Fix · GHSA-hqj5-cw9f-rx67 swagger-typescript-api (npm) Fixed in 13.12.2 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-54662
- 2026-10-03 Alias added: GHSA-hqj5-cw9f-rx67
References
Other 5
- https://github.com/acacode/swagger-typescript-api/security/advisories/GHSA-hqj5-cw9f-rx67
- https://github.com/acacode/swagger-typescript-api/pull/1779
- https://github.com/acacode/swagger-typescript-api/commit/306d59acb8ffbb00f953f807b97234b21f51d9de
- https://github.com/acacode/swagger-typescript-api/releases/tag/v13.12.2
- https://github.com/acacode/swagger-typescript-api
More acacode vulnerabilities
- TI-2026-39492 swagger-typescript-api vulnerable to code injection via unescaped OpenAPI path strings in generated method bodies CVSS 3.1HIGH 8.3
- TI-2026-39490 swagger-typescript-api vulnerable to code injection via unescaped enum string values CVSS 3.1HIGH 8.3
- TI-2026-39486 swagger-typescript-api vulnerable to authorization-token exfiltration via spec `$ref` CVSS 3.1HIGH 7.4
- TI-2026-39489 swagger-typescript-api vulnerable to Server-Side Request Forgery via spec `$ref` CVSS 3.1MEDIUM 6.1
- TI-2026-39487 swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in axios http-client template CVSS 3.1HIGH 8.3
Sources
- CVE-2026-54662 · CVE Program
- CVE-2026-54662 · NVD
- FIRST EPSS
- GHSA-hqj5-cw9f-rx67 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences