The swagger-typescript-api package generates API clients from OpenAPI specifications. Versions before 13.12.2 improperly neutralize special elements in enum values from components.schemas.*.enum[i] by passing them directly to Ts.StringValue without escaping. These values are then rendered in TypeScript enum declarations via templates/base/enum-data-contract.ejs. This improper neutralization allows an attacker who controls the OpenAPI spec to inject malicious code that executes upon importing the generated module. The vulnerability is tracked as CWE-74 (Improper Neutralization of Special Elements in Output), with related weaknesses CWE-94 and CWE-1336. The flaw is resolved in version 13.12.2.

Successful exploitation allows an attacker to inject and execute arbitrary code in the context of the generated TypeScript module when it is imported. This can lead to full compromise of the environment where the generated code runs, including confidentiality, integrity, and availability impacts as indicated by the CVSS vector (Confidentiality: High, Integrity: High, Availability: High).

Upgrade to swagger-typescript-api version 13.12.2 or later, where this vulnerability is fixed by properly escaping enum values before rendering. No other mitigation is indicated or required.