CVE-2026-54662 acacode CVE debrief

Who should care

Developers and security teams using swagger-typescript-api, especially those integrating OpenAPI specifications from untrusted sources, should assess their exposure and take necessary actions to mitigate the vulnerability.

Why it matters

CVE-2026-54662 is a high-severity vulnerability in swagger-typescript-api that allows code injection via OpenAPI specifications. Developers and security teams should assess exposure, especially when integrating untrusted specifications, and upgrade to version 13.12.2 or later.

• Potential code injection and execution via attacker-controlled OpenAPI specifications.
• Possible compromise of systems using vulnerable versions of swagger-typescript-api.
• Need for verification of OpenAPI specification integrity and validation.

Technical summary

The swagger-typescript-api library generates API clients for Fetch or Axios from OpenAPI specifications. Prior to version 13.12.2, the library is vulnerable to code injection via attacker-controlled OpenAPI specifications. The issue arises from the insecure interpolation of the baseUrl field in the generated HttpClient without proper escaping. This allows an attacker-controlled OpenAPI spec to inject TypeScript static field code that executes when the generated fetch client module is imported. The fix is included in version 13.12.2, which properly escapes the baseUrl field to prevent code injection.

Defensive priority

High priority for developers and security teams using swagger-typescript-api, especially those integrating OpenAPI specifications from untrusted sources.

Recommended defensive actions

• Developers and security teams should assess exposure and upgrade to version 13.12.2 or later.
• Verify the integrity of OpenAPI specifications used in swagger-typescript-api.
• Implement compensating controls, such as validating and sanitizing OpenAPI specifications.
• Review relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in swagger-typescript-api. The issue allows an attacker-controlled OpenAPI spec to inject TypeScript static field code. The fix is included in version 13.12.2.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.