Riskcovery

CVE-2026-54661

swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in axios http-client template

State
Published
Severity
8.3 High
Published
Jul 29, 2026
Updated
Jul 29, 2026
Reserved
Jun 15, 2026

Read the record on cve.org

Description

swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, templates/base/http-clients/axios-http-client.ejs interpolates servers[0].url from src/code-gen-process.ts into the HttpClient constructor without escaping, allowing an attacker-controlled OpenAPI spec to inject code that executes when new HttpClient() or new Api() is constructed. This issue is fixed in version 13.12.2.

Scores

CVSSScoreVectorSource
3.18.3 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:HGitHub_M

Weaknesses

  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
  • CWE-94 Improper Control of Generation of Code ('Code Injection')
  • CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine

Affected Products

ProductVersions
swagger-typescript-apiacacode
  • < 13.12.2Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.