CVE-2026-54662: swagger-typescript-api RCE Vulnerability

CVE-2026-54662 Overview

CVE-2026-54662 is a code injection vulnerability in swagger-typescript-api, a tool that generates TypeScript API clients for Fetch or Axios from OpenAPI specifications. Versions prior to 13.12.2 interpolate the servers[0].url value from an OpenAPI spec directly into a generated TypeScript module without escaping. An attacker who controls an OpenAPI specification consumed by the generator can inject arbitrary TypeScript static field code that executes when the generated fetch client module is imported. The flaw is tracked as [CWE-74] Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection).

Critical Impact
Attacker-controlled OpenAPI specs can inject TypeScript code that executes at module import time in developer or build environments, leading to arbitrary code execution.

Affected Products

swagger-typescript-api versions prior to 13.12.2
Generated Fetch HTTP client modules produced by affected versions
Build pipelines and developer environments that consume untrusted OpenAPI specifications

Discovery Timeline

2026-07-29 - CVE-2026-54662 published to NVD
2026-07-29 - Last updated in NVD database
Patch released in swagger-typescript-api version 13.12.2 via pull request #1779 and GitHub Security Advisory GHSA-hqj5-cw9f-rx67

Technical Details for CVE-2026-54662

Vulnerability Analysis

The vulnerability resides in the code-generation pipeline of swagger-typescript-api. The function createApiConfig in src/code-gen-process.ts copies the servers[0].url value from an OpenAPI specification into apiConfig.baseUrl. The EJS template templates/base/http-clients/fetch-http-client.ejs then interpolates that value into the generated HttpClient class as a TypeScript static field. Because the interpolation performs no escaping or quoting of special characters, an attacker can craft a servers[0].url string that closes the enclosing string literal and appends arbitrary TypeScript expressions. When the generated module is imported by a downstream application, the injected static field initializer executes in the JavaScript runtime.

Root Cause

The root cause is missing output-context escaping. Untrusted spec input is treated as trusted source code during template rendering. TypeScript static field values must be encoded as safe JavaScript string literals, but the template used raw interpolation instead of a JavaScript string literal escape routine.

Attack Vector

Exploitation requires that a developer or automated build pipeline run swagger-typescript-api against an attacker-controlled OpenAPI document. This can occur when consuming third-party API specifications, mirroring a public spec, or importing definitions from an untrusted registry. User interaction is required to invoke the generator, and attack complexity is elevated because a valid spec must be crafted. Once the generated client is imported, the injected code executes with the privileges of the importing process, which typically includes access to source trees, environment variables, and CI/CD secrets.

typescript

// Patch excerpt: src/code-gen-process.ts
 import { JavascriptTranslator } from "./translators/javascript.js";
 import type { TranslatorIO } from "./translators/translator.js";
 import { TypeNameFormatter } from "./type-name-formatter.js";
+import { escapeJsStringLiteral } from "./util/escape-js-string-literal.js";
 import { FileSystem } from "./util/file-system.js";
 import { createLodashCompat } from "./util/lodash-compat.js";
 import { NameResolver } from "./util/name-resolver.js";

// Patch excerpt: src/configuration.ts
 import type { MonoSchemaParser } from "./schema-parser/mono-schema-parser.js";
 import type { SchemaParser } from "./schema-parser/schema-parser.js";
 import type { Translator } from "./translators/translator.js";
+import { escapeJsStringLiteral } from "./util/escape-js-string-literal.js";
 import { objectAssign } from "./util/object-assign.js";
// Source: https://github.com/acacode/swagger-typescript-api/commit/306d59acb8ffbb00f953f807b97234b21f51d9de

The fix introduces an escapeJsStringLiteral utility and applies it to spec-derived values before they are interpolated into generated source files.

Detection Methods for CVE-2026-54662

Indicators of Compromise

Generated http-client.ts files where the baseUrl static field contains characters beyond a URL string, such as backticks, unescaped quotes, or embedded expressions
OpenAPI specifications where servers[0].url includes characters like ", `, ;, or ${ that are not valid in a URL
Unexpected outbound network connections or file-system access initiated at module import time from generated API client code

Detection Strategies

Perform static analysis of generated client files to verify that baseUrl contains only a syntactically valid URL literal
Scan package.json and lockfiles for swagger-typescript-api versions below 13.12.2
Review OpenAPI specifications ingested by build pipelines for anomalous servers entries before generation runs

Monitoring Recommendations

Log and audit all OpenAPI specification sources consumed by CI/CD jobs, and enforce checksums for trusted specs
Alert on new or modified generated client files whose diffs touch the HttpClientbaseUrl field
Monitor developer workstations and build agents for unexpected child processes spawned during npm install, npm run build, or test runs

How to Mitigate CVE-2026-54662

Immediate Actions Required

Upgrade swagger-typescript-api to version 13.12.2 or later in all projects and CI pipelines
Regenerate any API clients that were produced from third-party or untrusted OpenAPI specifications using a patched version
Audit existing generated client files for injected code before continuing to build or ship affected applications

Patch Information

The fix is included in swagger-typescript-api release v13.12.2. The patch adds an escapeJsStringLiteral helper and applies it to spec-derived values during code generation. Technical details are available in the GitHub commit and Security Advisory GHSA-hqj5-cw9f-rx67.

Workarounds

Only run swagger-typescript-api against OpenAPI specifications from trusted, verified sources
Manually validate that servers[0].url in each spec is a well-formed URL before invoking the generator
Isolate code-generation steps in an ephemeral sandboxed container with no access to secrets or production credentials

bash

# Upgrade to the patched release
npm install --save-dev swagger-typescript-api@^13.12.2

# Verify the installed version
npm ls swagger-typescript-api

# Optional: validate a spec's server URL before generation
node -e "const s=require('./openapi.json');new URL(s.servers[0].url);console.log('ok')"