CVE-2026-54662

01/תיאור (מקור, אנגלית)

swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/code-gen-process.ts createApiConfig copies servers[0].url into apiConfig.baseUrl, and templates/base/http-clients/fetch-http-client.ejs interpolates apiConfig.baseUrl into the generated HttpClient baseUrl field without escaping, allowing an attacker-controlled OpenAPI spec to inject TypeScript static field code that executes when the generated fetch client module is imported. This issue is fixed in version 13.12.2.

02/קישורים5

• github.com/acacode/swagger-typescript-api/commit/306d59acb8ffb‮…
• github.com/acacode/swagger-typescript-api/pull/1779
• github.com/acacode/swagger-typescript-api/releases/tag/v13.12.2
• github.com/acacode/swagger-typescript-api/security/advisories/‮…
• github.com/acacode/swagger-typescript-api/security/advisories/‮…