CVE-2026-54664

swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, src/schema-parser/base-schema-parsers/enum.ts passes components.schemas.*.enum[i] values to Ts.StringValue in src/configuration.ts without escaping before templates/base/enum-data-contract.ejs renders TypeScript enum declarations, allowing an attacker-controlled OpenAPI spec to inject code that executes when the generated module is imported. This issue is fixed in version 13.12.2.

CVSS v3 8.3 HIGH

8.3^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.6 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://github.com/acacode/swagger-typescript-api/commit/306d59acb8ffbb00f953f807b97234b21f51d9de
https://github.com/acacode/swagger-typescript-api/pull/1779
https://github.com/acacode/swagger-typescript-api/releases/tag/v13.12.2
https://github.com/acacode/swagger-typescript-api/security/advisories/GHSA-5f94-x226-ccpm

Configurations

No configuration.

History

23 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) swagger-typescript-api genera clientes API para Fetch o Axios a partir de una especificación OpenAPI. Antes de la versión 13.12.2, src/schema-parser/base-schema-parsers/enum.ts pasa los valores de components.schemas.*.enum[i] a Ts.StringValue en src/configuration.ts sin escapar antes de que templates/base/enum-data-contract.ejs renderice las declaraciones de enumeración de TypeScript, lo que permite que una especificación OpenAPI controlada por un atacante inyecte código que se ejecuta cuando se importa el módulo generado. Este problema se ha solucionado en la versión 13.12.2.

Information

Published : 2026-07-29 15:16

Updated : 2026-10-23 23:10

NVD link : CVE-2026-54664

Mitre link : CVE-2026-54664

CVE.ORG link : CVE-2026-54664

JSON object : View

Products Affected

No product.

CWE

CWE-74

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

CWE-94

Improper Control of Generation of Code ('Code Injection')

CWE-1336

Improper Neutralization of Special Elements Used in a Template Engine

{"id": "CVE-2026-54664", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54664", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-30T13:39:16.270332Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 1.6}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "acacode", "product": "swagger-typescript-api", "versions": [{"status": "affected", "version": "< 13.12.2"}]}]}], "published": "2026-07-29T15:16:25.850", "references": [{"url": "https://github.com/acacode/swagger-typescript-api/commit/306d59acb8ffbb00f953f807b97234b21f51d9de", "source": "security-advisories@github.com"}, {"url": "https://github.com/acacode/swagger-typescript-api/pull/1779", "source": "security-advisories@github.com"}, {"url": "https://github.com/acacode/swagger-typescript-api/releases/tag/v13.12.2", "source": "security-advisories@github.com"}, {"url": "https://github.com/acacode/swagger-typescript-api/security/advisories/GHSA-5f94-x226-ccpm", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-74"}, {"lang": "en", "value": "CWE-94"}, {"lang": "en", "value": "CWE-1336"}]}], "descriptions": [{"lang": "en", "value": "swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, src/schema-parser/base-schema-parsers/enum.ts passes components.schemas.*.enum[i] values to Ts.StringValue in src/configuration.ts without escaping before templates/base/enum-data-contract.ejs renders TypeScript enum declarations, allowing an attacker-controlled OpenAPI spec to inject code that executes when the generated module is imported. This issue is fixed in version 13.12.2."}, {"lang": "es", "value": "swagger-typescript-api genera clientes API para Fetch o Axios a partir de una especificaci\u00f3n OpenAPI. Antes de la versi\u00f3n 13.12.2, src/schema-parser/base-schema-parsers/enum.ts pasa los valores de components.schemas.*.enum[i] a Ts.StringValue en src/configuration.ts sin escapar antes de que templates/base/enum-data-contract.ejs renderice las declaraciones de enumeraci\u00f3n de TypeScript, lo que permite que una especificaci\u00f3n OpenAPI controlada por un atacante inyecte c\u00f3digo que se ejecuta cuando se importa el m\u00f3dulo generado. Este problema se ha solucionado en la versi\u00f3n 13.12.2."}], "lastModified": "2026-10-23T23:10:00.157", "sourceIdentifier": "security-advisories@github.com"}