The swagger-typescript-api package versions before 13.12.2 contain an injection vulnerability (CWE-74) due to improper neutralization of special elements in output used by a downstream component. Specifically, the createApiConfig function copies the first server URL from the OpenAPI spec into apiConfig.baseUrl without escaping, and this value is directly interpolated into the generated TypeScript HttpClient baseUrl field. An attacker controlling the OpenAPI specification can inject arbitrary TypeScript static field code that executes upon module import. This vulnerability is addressed in version 13.12.2.

Successful exploitation allows an attacker who can supply a malicious OpenAPI specification to inject and execute arbitrary TypeScript code in the generated client module. This can lead to complete compromise of the client environment, including confidentiality, integrity, and availability impacts as indicated by the CVSS score of 8.3 (high severity).

Upgrade to swagger-typescript-api version 13.12.2 or later, where this injection vulnerability is fixed. No other official remediation or temporary fixes are documented. Users should avoid generating clients from untrusted OpenAPI specifications until patched.