CVE-2026-54661 acacode CVE debrief

Who should care

Developers and maintainers of API clients generated with swagger-typescript-api, especially those using Axios HttpClient, should assess exposure and update to version 13.12.2 or later.

Why it matters

CVE-2026-54661 allows code injection in swagger-typescript-api via OpenAPI Specification. Developers should update to version 13.12.2 or later, assess exposure of generated API clients, and verify HttpClient and Api constructor usage.

• Code injection via OpenAPI Specification
• Potential for arbitrary code execution during HttpClient or Api construction
• Need for verification of HttpClient and Api usage in applications
• Priority for updating to fixed version 13.12.2 or later

Technical summary

swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, templates/base/http-clients/axios-http-client.ejs interpolates servers[0].url from src/code-gen-process.ts into the HttpClient constructor without escaping, allowing an attacker-controlled OpenAPI spec to inject code that executes when new HttpClient() or new Api() is constructed. The vulnerability is fixed in version 13.12.2, which addresses the code injection issue by properly escaping the interpolated values.

Defensive priority

High

Recommended defensive actions

• Review and update swagger-typescript-api to version 13.12.2 or later
• Assess exposure of API clients generated with vulnerable versions
• Verify HttpClient and Api constructor usage in your application
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in swagger-typescript-api. The issue is fixed in version 13.12.2. Evidence from the CVE Program and NIST NVD confirms the vulnerability and its resolution. Additional verification is recommended for HttpClient and Api constructor usage in applications. The vulnerability allows code injection via OpenAPI Specification, which can lead to arbitrary code execution.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.