{"id":"CVE-2026-54662","sourceIdentifier":"security-advisories@github.com","published":"2026-07-29T15:16:25.577","lastModified":"2026-10-23T23:10:00.157","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/code-gen-process.ts createApiConfig copies servers[0].url into apiConfig.baseUrl, and templates/base/http-clients/fetch-http-client.ejs interpolates apiConfig.baseUrl into the generated HttpClient baseUrl field without escaping, allowing an attacker-controlled OpenAPI spec to inject TypeScript static field code that executes when the generated fetch client module is imported. This issue is fixed in version 13.12.2."},{"lang":"es","value":"swagger-typescript-api genera clientes API para Fetch o Axios a partir de especificaciones OpenAPI. Antes de la versión 13.12.2, src/code-gen-process.ts createApiConfig copia servers[0].url en apiConfig.baseUrl, y templates/base/http-clients/fetch-http-client.ejs interpola apiConfig.baseUrl en el campo baseUrl del HttpClient generado sin escapar, permitiendo que una especificación OpenAPI controlada por un atacante inyecte código de campo estático de TypeScript que se ejecuta cuando se importa el módulo del cliente fetch generado. Este problema está solucionado en la versión 13.12.2."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"acacode","product":"swagger-typescript-api","versions":[{"version":"< 13.12.2","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","baseScore":8.3,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.6,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-07-29T15:15:30.473520Z","id":"CVE-2026-54662","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-74"},{"lang":"en","value":"CWE-94"},{"lang":"en","value":"CWE-1336"}]}],"references":[{"url":"https://github.com/acacode/swagger-typescript-api/commit/306d59acb8ffbb00f953f807b97234b21f51d9de","source":"security-advisories@github.com"},{"url":"https://github.com/acacode/swagger-typescript-api/pull/1779","source":"security-advisories@github.com"},{"url":"https://github.com/acacode/swagger-typescript-api/releases/tag/v13.12.2","source":"security-advisories@github.com"},{"url":"https://github.com/acacode/swagger-typescript-api/security/advisories/GHSA-hqj5-cw9f-rx67","source":"security-advisories@github.com"},{"url":"https://github.com/acacode/swagger-typescript-api/security/advisories/GHSA-hqj5-cw9f-rx67","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}