CyberRota Analysis
AI-GeneratedThe vulnerability affects swagger-typescript-api versions prior to 13.12.2, where an attacker can exploit the improper handling of the OpenAPI specification to inject malicious TypeScript code into the generated API client. This can lead to remote code execution when the affected client module is imported, posing a significant risk to applications relying on this tool for API client generation. Organizations using swagger-typescript-api should prioritize upgrading to version 13.12.2 to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/code-gen-process.ts createApiConfig copies servers[0].url into apiConfig.baseUrl, and templates/base/http-clients/fetch-http-client.ejs interpolates apiConfig.baseUrl into the generated HttpClient baseUrl field without escaping, allowing an attacker-controlled OpenAPI spec to inject TypeScript static field code that executes when the generated fetch client module is imported. This issue is fixed in version 13.12.2.