DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-54666: CVE-2026-54666: Remote Code Execution via OpenAPI Route Path Injection in swagger-typescript-api

#security #cve #cybersecurity

CVE-2026-54666: Remote Code Execution via OpenAPI Route Path Injection in swagger-typescript-api

Vulnerability ID: CVE-2026-54666
CVSS Score: 8.3
Published: 2026-07-29

CVE-2026-54666 identifies a high-severity code injection vulnerability in the swagger-typescript-api code generator library. The library fails to sanitize route paths parsed from OpenAPI Specification (OAS) documents before interpolating them into generated TypeScript and JavaScript client code. When a developer processes a compromised or malicious OpenAPI specification file, the library writes unescaped string literals and dynamic execution blocks directly into backtick template literals. When the generated client's corresponding API method is executed, the embedded JavaScript executes dynamically with the privileges of the active process.

TL;DR

The swagger-typescript-api code generator fails to sanitize route paths. An attacker can craft a malicious OpenAPI specification with embedded JavaScript in a route path to execute arbitrary code when the generated API client is run.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-94 / CWE-1336
  • Attack Vector: Network (AV:N)
  • CVSS v3.1 Score: 8.3
  • Exploit Status: Proof-of-Concept
  • CISA KEV Status: Not Listed
  • Ecosystem: npm

Affected Systems

  • swagger-typescript-api npm package versions prior to 13.12.2
  • swagger-typescript-api: < 13.12.2 (Fixed in: 13.12.2)

Code Analysis

Commit: 306d59a

Fix RCE via route path template injection by implementing escape utility.

Exploit Details

Mitigation Strategies

  • Upgrade swagger-typescript-api to version 13.12.2 or later.
  • Scan all generated client source code files for unescaped expressions inside template literals.
  • Implement strict schema validation to block route definitions that contain special characters like backticks or execution strings.

Remediation Steps:

  1. Open your project directory and execute the package manager upgrade command: npm install swagger-typescript-api@13.12.2.
  2. Inspect the generated configuration and files (such as Api.ts or HttpClient.ts) for instances of path: containing ${ characters.
  3. Integrate automated linting or security scanning into build pipelines to block deployment if unescaped patterns are matched.

References

Read the full report for CVE-2026-54666 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)