CyberRota Analysis
AI-GeneratedThe swagger-typescript-api tool is vulnerable to code injection due to improper handling of enum values from an OpenAPI Specification, which can lead to arbitrary code execution when the generated TypeScript module is imported. This high-severity vulnerability poses significant risks for developers using versions prior to 13.12.2, particularly those integrating third-party OpenAPI specs. Organizations relying on this tool should prioritize upgrading to version 13.12.2 to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, src/schema-parser/base-schema-parsers/enum.ts passes components.schemas.*.enum[i] values to Ts.StringValue in src/configuration.ts without escaping before templates/base/enum-data-contract.ejs renders TypeScript enum declarations, allowing an attacker-controlled OpenAPI spec to inject code that executes when the generated module is imported. This issue is fixed in version 13.12.2.