CVE-2026-54661: swagger-typescript-api RCE Vulnerability

CVE-2026-54661 Overview

CVE-2026-54661 is a code injection vulnerability in swagger-typescript-api, a generator that produces API clients for Fetch or Axios from OpenAPI specifications. Versions prior to 13.12.2 interpolate the servers[0].url value from an OpenAPI specification directly into the generated HttpClient constructor without escaping. An attacker who supplies a malicious OpenAPI spec can inject JavaScript that executes when the generated client instantiates new HttpClient() or new Api(). The flaw is classified under CWE-74: Improper Neutralization of Special Elements in Output.

Critical Impact
Untrusted OpenAPI specifications can trigger arbitrary JavaScript execution in any application that instantiates the generated API client, leading to full compromise of the host process.

Affected Products

swagger-typescript-api versions prior to 13.12.2
Applications consuming generated clients built from untrusted OpenAPI specs
Build pipelines and developer workstations running the generator against attacker-controlled specifications

Discovery Timeline

2026-07-29 - CVE-2026-54661 published to NVD
2026-07-29 - Last updated in NVD database
v13.12.2 - Fix released via GitHub Release v13.12.2

Technical Details for CVE-2026-54661

Vulnerability Analysis

The vulnerability lives in the EJS template templates/base/http-clients/axios-http-client.ejs. The template inlines the first server URL from the OpenAPI document, sourced through src/code-gen-process.ts, directly into a generated JavaScript string literal. Because no escaping is applied, a crafted servers[0].url value can close the enclosing string and append arbitrary JavaScript. The injected payload becomes part of the generated client source and executes the moment code instantiates new HttpClient() or new Api().

This is a template-injection style flaw that turns a build-time input (servers[0].url) into a runtime code execution primitive. Any workflow that trusts third-party OpenAPI documents — SDK factories, API marketplaces, CI jobs that fetch specs from remote registries — is exposed.

Root Cause

The generator treats servers[0].url as trusted string data and interpolates it into a JavaScript source template. The fix introduces an escapeJsStringLiteral utility and applies it in both src/code-gen-process.ts and src/configuration.ts so that user-controlled values are safely encoded before being written into generated code.

Attack Vector

Exploitation requires an attacker to influence the OpenAPI specification consumed by swagger-typescript-api and requires a developer or automated pipeline to run the generator and then execute the produced client. The attacker controls the servers[0].url field, breaks out of the surrounding string literal, and appends arbitrary JavaScript that runs under the privileges of the Node.js process instantiating the client.

typescript

// Patch excerpt: src/code-gen-process.ts
 import { JavascriptTranslator } from "./translators/javascript.js";
 import type { TranslatorIO } from "./translators/translator.js";
 import { TypeNameFormatter } from "./type-name-formatter.js";
+import { escapeJsStringLiteral } from "./util/escape-js-string-literal.js";
 import { FileSystem } from "./util/file-system.js";
 import { createLodashCompat } from "./util/lodash-compat.js";
 import { NameResolver } from "./util/name-resolver.js";

// Patch excerpt: src/configuration.ts
 import type { MonoSchemaParser } from "./schema-parser/mono-schema-parser.js";
 import type { SchemaParser } from "./schema-parser/schema-parser.js";
 import type { Translator } from "./translators/translator.js";
+import { escapeJsStringLiteral } from "./util/escape-js-string-literal.js";
 import { objectAssign } from "./util/object-assign.js";

Source: GitHub commit 306d59a. Both hunks introduce the escapeJsStringLiteral helper that neutralizes the injection sink.

Detection Methods for CVE-2026-54661

Indicators of Compromise

Generated client files containing suspicious characters (backticks, quotes, ${, ;, or newline sequences) inside the constructor's base URL literal.
Unexpected child processes, outbound network connections, or file writes originating from Node.js processes shortly after instantiating a generated API client.
OpenAPI specifications with servers[].url values that contain quote characters, template literal delimiters, or JavaScript keywords such as require, process, or eval.

Detection Strategies

Diff generated http-client.ts output against a known-good baseline and alert on non-URL content inside the baseURL assignment.
Add static analysis to CI that parses generated client source with an AST parser and rejects builds where the base URL literal contains statements or expressions.
Validate OpenAPI documents before generation: enforce that servers[].url parses as a valid absolute URL and reject specs containing embedded quotes or backslashes.

Monitoring Recommendations

Monitor build agents for anomalous process execution originating from node, npx swagger-typescript-api, or downstream test runners.
Track dependency versions in software bills of materials (SBOMs) and flag any project pinning swagger-typescript-api below 13.12.2.
Log and review the provenance of OpenAPI specifications ingested by build pipelines, especially those fetched from remote or third-party sources.

How to Mitigate CVE-2026-54661

Immediate Actions Required

Upgrade swagger-typescript-api to 13.12.2 or later in all projects and CI pipelines.
Regenerate all API clients previously produced from external or untrusted OpenAPI specifications using the patched version.
Audit existing generated client files for injected content in the base URL literal and remove or regenerate affected artifacts.

Patch Information

The fix ships in swagger-typescript-api v13.12.2, landed via Pull Request #1779 and commit 306d59a. Details are documented in GHSA-38c3-wv3c-v3xj. The patch introduces escapeJsStringLiteral and applies it wherever spec-derived strings are written into generated JavaScript.

Workarounds

Treat OpenAPI specifications as untrusted input and validate servers[].url against a strict URL grammar before invoking the generator.
Run the generator inside an ephemeral, network-isolated sandbox (container, VM) so that any injected code cannot reach production credentials or infrastructure.
Manually sanitize or override the servers[].url value in the spec before generation until the upgrade to 13.12.2 is deployed.

bash

# Configuration example: upgrade and pin the fixed version
npm install --save-dev swagger-typescript-api@^13.12.2
npm ls swagger-typescript-api

# Optional: validate spec server URLs before generation
node -e "const s=require('./openapi.json');s.servers.forEach(x=>{new URL(x.url)});console.log('server URLs OK')"