CVE-2026-54666: swagger-typescript-api RCE Vulnerability

CVE-2026-54666 Overview

CVE-2026-54666 is a code injection vulnerability in swagger-typescript-api, a tool that generates Fetch or Axios API clients from an OpenAPI Specification. Versions prior to 13.12.2 pass OpenAPI path keys through parseRouteName into the templates/default/procedure-call.ejs and templates/modular/procedure-call.ejs templates without escaping JavaScript template literal interpolation. An attacker-controlled path containing ${...} becomes executable JavaScript when the generated client method is invoked. The issue is classified under [CWE-74] (Improper Neutralization of Special Elements in Output) and is fixed in version 13.12.2.

Critical Impact
A malicious OpenAPI specification can inject arbitrary JavaScript into generated API client code, leading to code execution in any process that calls the resulting method.

Affected Products

swagger-typescript-api versions prior to 13.12.2
Generated clients built from the templates/default/procedure-call.ejs template
Generated clients built from the templates/modular/procedure-call.ejs template

Discovery Timeline

2026-07-29 - CVE-2026-54666 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-54666

Vulnerability Analysis

The swagger-typescript-api code generator reads path keys from an OpenAPI document and emits TypeScript client methods that reference those paths inside JavaScript template literals (backtick strings). The function parseRouteName in src/schema-routes/schema-routes.ts forwarded raw path segments into the EJS templates that assemble each method body. Because the emitted code wrapped the path in backticks without neutralizing the ${ sequence, any interpolation expression embedded in the path was preserved verbatim in the generated source. When the client method is later invoked at runtime, the JavaScript engine evaluates the injected expression in the caller's scope. This turns generation-time input into runtime execution, expanding the impact beyond the code generator itself.

Root Cause

The root cause is missing output encoding of untrusted string data destined for a JavaScript template literal context. The templates concatenated route strings using backticks, but the generator did not call any escape routine for \``, \, or ${. The fix in commit 306d59aintroduces a new helper,escapeJsStringLiteral, and applies it at the code-generation boundary in src/code-gen-process.tsandsrc/configuration.ts`.

Attack Vector

Exploitation requires an attacker to supply or influence the OpenAPI specification consumed by swagger-typescript-api. This is realistic in workflows that pull specs from third-party services, public registries, or downstream partners. The attacker crafts a path such as /users/${process.mainModule.require('child_process').execSync('...')} in the OpenAPI document. When a developer runs the generator, the malicious interpolation is embedded in the emitted client. Any subsequent call to the generated method triggers evaluation of the injected expression in the host application's context.

typescript

// Security patch in src/code-gen-process.ts
 import { JavascriptTranslator } from "./translators/javascript.js";
 import type { TranslatorIO } from "./translators/translator.js";
 import { TypeNameFormatter } from "./type-name-formatter.js";
+import { escapeJsStringLiteral } from "./util/escape-js-string-literal.js";
 import { FileSystem } from "./util/file-system.js";
 import { createLodashCompat } from "./util/lodash-compat.js";
 import { NameResolver } from "./util/name-resolver.js";

// Security patch in src/configuration.ts
 import type { MonoSchemaParser } from "./schema-parser/mono-schema-parser.js";
 import type { SchemaParser } from "./schema-parser/schema-parser.js";
 import type { Translator } from "./translators/translator.js";
+import { escapeJsStringLiteral } from "./util/escape-js-string-literal.js";
 import { objectAssign } from "./util/object-assign.js";

Source: GitHub commit 306d59a. The patch imports and applies escapeJsStringLiteral where path values enter generated template literals.

Detection Methods for CVE-2026-54666

Indicators of Compromise

Generated TypeScript client files that contain ${ sequences inside route template literals that do not correspond to declared path parameters.
OpenAPI specifications where paths keys contain characters such as `, ${, or unbalanced } outside standard {param} placeholders.
Unexpected outbound network connections or child-process activity originating from developer machines or CI runners immediately after running swagger-typescript-api.

Detection Strategies

Statically scan generated client output for template literal interpolation tokens (${) inside route strings and diff against the source OpenAPI paths.
Pin and verify the swagger-typescript-api version in build manifests; alert when versions below 13.12.2 are used.
Review pull requests that update or replace OpenAPI documents for suspicious path keys before code generation runs.

Monitoring Recommendations

Instrument CI/CD pipelines to log commands, network calls, and spawned processes during code-generation steps.
Track dependency inventories with software composition analysis to flag vulnerable swagger-typescript-api releases across repositories.
Monitor developer workstations for anomalous process execution during OpenAPI client generation using endpoint telemetry.

How to Mitigate CVE-2026-54666

Immediate Actions Required

Upgrade swagger-typescript-api to version 13.12.2 or later in every project and CI pipeline that consumes OpenAPI specifications.
Regenerate all API clients previously produced with vulnerable versions and audit the emitted TypeScript for injected ${...} expressions.
Treat third-party OpenAPI documents as untrusted input and review path keys before running the generator.

Patch Information

The fix is available in swagger-typescript-api v13.12.2. The change is implemented in pull request #1779 and commit 306d59a, which introduces the escapeJsStringLiteral helper. Full details are documented in GitHub Security Advisory GHSA-w284-33mx-6g9v.

Workarounds

Restrict swagger-typescript-api execution to OpenAPI documents sourced from trusted internal repositories until upgrade completes.
Pre-process OpenAPI specifications to reject or sanitize any path key containing `, ${, or } characters outside {param} placeholders.
Run the code generator inside an isolated sandbox or ephemeral container without network egress or credentials.

bash

# Upgrade to the patched release
npm install --save-dev swagger-typescript-api@^13.12.2

# Verify installed version
npm ls swagger-typescript-api

# Simple guard: fail the build if a path contains template literal syntax
grep -RE '\"paths\"|\\$\\{' ./openapi/*.json && exit 1 || echo "paths clean"