CyberRota Analysis
AI-GeneratedThe swagger-typescript-api tool prior to version 13.12.2 is vulnerable due to improper escaping of JavaScript template literals in generated API clients, allowing attackers to inject and execute arbitrary code through manipulated OpenAPI path keys. This vulnerability poses a significant risk to applications that utilize this tool for generating API clients, potentially leading to unauthorized code execution. Developers and organizations using swagger-typescript-api should prioritize upgrading to version 13.12.2 or later to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, src/schema-routes/schema-routes.ts passes OpenAPI path keys through parseRouteName to templates/default/procedure-call.ejs and templates/modular/procedure-call.ejs without escaping JavaScript template literal interpolation, allowing an attacker-controlled path containing ${...} to execute when the generated method is called. This issue is fixed in version 13.12.2.