CVE-2026-54664: swagger-typescript-api RCE Vulnerability

CVE-2026-54664 Overview

CVE-2026-54664 is a code injection vulnerability [CWE-74] in swagger-typescript-api, a widely used generator that produces TypeScript API clients for Fetch or Axios from an OpenAPI Specification. Versions prior to 13.12.2 pass components.schemas.*.enum[i] values from an OpenAPI document to Ts.StringValue in src/configuration.ts without escaping. The templates/base/enum-data-contract.ejs template then renders these values directly into TypeScript enum declarations. An attacker who controls the OpenAPI specification can inject JavaScript that executes when the generated module is imported. The maintainers fixed the issue in version 13.12.2.

Critical Impact
Attacker-controlled OpenAPI specifications can inject arbitrary JavaScript into generated TypeScript client code, achieving code execution in any process that imports the generated module.

Affected Products

swagger-typescript-api versions prior to 13.12.2
Node.js build pipelines and developer workstations that generate clients from untrusted OpenAPI specs
Downstream applications that import the generated TypeScript client modules

Discovery Timeline

2026-07-29 - CVE-2026-54664 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-54664

Vulnerability Analysis

The flaw lives in the code-generation pipeline of swagger-typescript-api. The parser at src/schema-parser/base-schema-parsers/enum.ts iterates over enum entries in an OpenAPI schema and forwards each string value into Ts.StringValue, defined in src/configuration.ts. That helper wraps the value in quotes but does not escape embedded quote characters, backslashes, or template delimiters. The EJS template templates/base/enum-data-contract.ejs then interpolates the wrapped literal directly into a .ts source file.

Because the generated file is a TypeScript module, importing it evaluates any injected expression. The attack occurs at code-generation time, but the payload fires later at import time inside the consuming application. This turns a data-only OpenAPI document into an execution primitive against build servers, CI runners, and downstream services.

Root Cause

The root cause is missing output encoding when serializing user-controlled strings into JavaScript source code. Ts.StringValue treated the input as a trusted string literal instead of untrusted data that must be escaped for a JavaScript string context. Fixing the vulnerability required introducing a dedicated escapeJsStringLiteral utility and routing enum values through it before template rendering.

Attack Vector

An attacker supplies or influences an OpenAPI specification consumed by a developer or CI system running swagger-typescript-api. The malicious enum value contains a closing quote followed by arbitrary JavaScript. When the generated client is imported, the injected code executes with the privileges of the importing process. Exploitation requires user interaction (running the generator) and a somewhat crafted spec, but no authentication.

typescript

// Security patch from commit 306d59a - src/configuration.ts
import type { MonoSchemaParser } from "./schema-parser/mono-schema-parser.js";
import type { SchemaParser } from "./schema-parser/schema-parser.js";
import type { Translator } from "./translators/translator.js";
import { escapeJsStringLiteral } from "./util/escape-js-string-literal.js";
import { objectAssign } from "./util/object-assign.js";

const TsKeyword = {
// ...

Source: GitHub Commit 306d59a

The patch introduces escapeJsStringLiteral and applies it in both src/configuration.ts and src/code-gen-process.ts so that every string value written into generated source is safely encoded.

Detection Methods for CVE-2026-54664

Indicators of Compromise

Generated TypeScript client files containing unusual characters inside enum declarations, such as unescaped quotes, backticks, or ${...} template expressions.
OpenAPI specifications with enum values containing quote characters, backslashes, or JavaScript syntax fragments.
Unexpected outbound network connections or child processes originating from Node.js build agents shortly after client generation.

Detection Strategies

Scan repositories and package manifests for swagger-typescript-api versions below 13.12.2 using software composition analysis tooling.
Diff generated client output before and after upgrading to 13.12.2 to identify previously injected payloads that persisted in committed artifacts.
Inspect CI logs for swagger-typescript-api invocations against externally sourced OpenAPI documents.

Monitoring Recommendations

Alert on new or modified enum declarations in generated *.ts files during pull request review.
Monitor build agents for anomalous process creation or outbound connections during and immediately after code generation.
Track ingestion of third-party OpenAPI specifications and treat them as untrusted input in threat models.

How to Mitigate CVE-2026-54664

Immediate Actions Required

Upgrade swagger-typescript-api to version 13.12.2 or later in all projects and CI pipelines.
Regenerate all TypeScript clients that were produced from untrusted OpenAPI specifications and review the diff.
Audit developer workstations and build servers that ran the vulnerable generator against externally provided specs.

Patch Information

The fix is available in GitHub Release v13.12.2. Technical background is documented in GitHub Security Advisory GHSA-5f94-x226-ccpm and Pull Request #1779. The patch adds an escapeJsStringLiteral helper and applies it wherever schema-derived strings are emitted into generated source.

Workarounds

Only run swagger-typescript-api against OpenAPI specifications from trusted, authenticated sources.
Validate and sanitize enum values in OpenAPI documents before generation, rejecting entries containing quotes, backslashes, or template literal syntax.
Execute code generation inside an isolated container or sandbox with no credentials and restricted network egress.

bash

# Upgrade to the patched release
npm install --save-dev swagger-typescript-api@^13.12.2

# Verify installed version
npm ls swagger-typescript-api