Threat Intelligence Database

swagger-typescript-api versions prior to 13.12.2 contain a vulnerability where OpenAPI path keys are passed into JavaScript template literals without proper escaping. This allows attacker-controlled input containing ${...} expressions to be executed when the generated API client method is called. The issue is fixed in version 13.12.2.

CVE-2026-54664 is a high-severity vulnerability in the acacode swagger-typescript-api tool that generates TypeScript API clients from OpenAPI specifications. Versions prior to 13.12.2 improperly neutralize special elements in enum values, allowing attacker-controlled OpenAPI specs to inject code that executes when the generated module is imported. This issue is fixed in version 13.12.2.

swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/resolved-swagger-schema.ts warmUpRemoteSchemasCache resolves external $ref URLs and fetchRemoteSchemaDocument uses isHttpUrl to fetch any http or https target without private IP, redirect, DNS rebinding, or same-origin validation, allowing an attacker-controlled OpenAPI spec to make the generator issue requests to internal or link-local services. This issue is fixed in version 13.12.2.

swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/code-gen-process.ts createApiConfig copies servers[0].url into apiConfig.baseUrl, and templates/base/http-clients/fetch-http-client.ejs interpolates apiConfig.baseUrl into the generated HttpClient baseUrl field without escaping, allowing an attacker-controlled OpenAPI spec to inject TypeScript static field code that executes when the generated fetch client module is imported. This issue is fixed in version 13.12.2.

swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, templates/base/http-clients/axios-http-client.ejs interpolates servers[0].url from src/code-gen-process.ts into the HttpClient constructor without escaping, allowing an attacker-controlled OpenAPI spec to inject code that executes when new HttpClient() or new Api() is constructed. This issue is fixed in version 13.12.2.

A vulnerability in swagger-typescript-api prior to version 13.12.2 allows exposure of sensitive bearer tokens. The issue occurs because the authorization token is forwarded to every URL fetched during schema resolution, enabling an attacker-controlled OpenAPI specification to exfiltrate the token to a cross-origin endpoint. This vulnerability has a high severity with a CVSS score of 7.4 and is fixed in version 13.12.2.