CVE-2026-54662

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-54662", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-15T20:16:46.199Z", "datePublished": "2026-07-29T14:26:15.992Z", "dateUpdated": "2026-07-29T15:16:06.092Z"}, "containers": {"cna": {"title": "swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in fetch http-client template", "problemTypes": [{"descriptions": [{"cweId": "CWE-74", "lang": "en", "description": "CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-94", "lang": "en", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-1336", "lang": "en", "description": "CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/acacode/swagger-typescript-api/security/advisories/GHSA-hqj5-cw9f-rx67", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/acacode/swagger-typescript-api/security/advisories/GHSA-hqj5-cw9f-rx67"}, {"name": "https://github.com/acacode/swagger-typescript-api/pull/1779", "tags": ["x_refsource_MISC"], "url": "https://github.com/acacode/swagger-typescript-api/pull/1779"}, {"name": "https://github.com/acacode/swagger-typescript-api/commit/306d59acb8ffbb00f953f807b97234b21f51d9de", "tags": ["x_refsource_MISC"], "url": "https://github.com/acacode/swagger-typescript-api/commit/306d59acb8ffbb00f953f807b97234b21f51d9de"}, {"name": "https://github.com/acacode/swagger-typescript-api/releases/tag/v13.12.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/acacode/swagger-typescript-api/releases/tag/v13.12.2"}], "affected": [{"vendor": "acacode", "product": "swagger-typescript-api", "versions": [{"version": "< 13.12.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-29T14:26:15.992Z"}, "descriptions": [{"lang": "en", "value": "swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/code-gen-process.ts createApiConfig copies servers[0].url into apiConfig.baseUrl, and templates/base/http-clients/fetch-http-client.ejs interpolates apiConfig.baseUrl into the generated HttpClient baseUrl field without escaping, allowing an attacker-controlled OpenAPI spec to inject TypeScript static field code that executes when the generated fetch client module is imported. This issue is fixed in version 13.12.2."}], "source": {"advisory": "GHSA-hqj5-cw9f-rx67", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/acacode/swagger-typescript-api/security/advisories/GHSA-hqj5-cw9f-rx67", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-29T15:15:30.473520Z", "id": "CVE-2026-54662", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-29T15:16:06.092Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-54662", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-07-29T15:15:30.473520Z"}}}], "references": [{"url": "https://github.com/acacode/swagger-typescript-api/security/advisories/GHSA-hqj5-cw9f-rx67", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-29T15:16:00.707Z"}}], "cna": {"title": "swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in fetch http-client template", "source": {"advisory": "GHSA-hqj5-cw9f-rx67", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "acacode", "product": "swagger-typescript-api", "versions": [{"status": "affected", "version": "< 13.12.2"}]}], "references": [{"url": "https://github.com/acacode/swagger-typescript-api/security/advisories/GHSA-hqj5-cw9f-rx67", "name": "https://github.com/acacode/swagger-typescript-api/security/advisories/GHSA-hqj5-cw9f-rx67", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/acacode/swagger-typescript-api/pull/1779", "name": "https://github.com/acacode/swagger-typescript-api/pull/1779", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/acacode/swagger-typescript-api/commit/306d59acb8ffbb00f953f807b97234b21f51d9de", "name": "https://github.com/acacode/swagger-typescript-api/commit/306d59acb8ffbb00f953f807b97234b21f51d9de", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/acacode/swagger-typescript-api/releases/tag/v13.12.2", "name": "https://github.com/acacode/swagger-typescript-api/releases/tag/v13.12.2", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/code-gen-process.ts createApiConfig copies servers[0].url into apiConfig.baseUrl, and templates/base/http-clients/fetch-http-client.ejs interpolates apiConfig.baseUrl into the generated HttpClient baseUrl field without escaping, allowing an attacker-controlled OpenAPI spec to inject TypeScript static field code that executes when the generated fetch client module is imported. This issue is fixed in version 13.12.2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-74", "description": "CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1336", "description": "CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-29T14:26:15.992Z"}}}, "cveMetadata": {"cveId": "CVE-2026-54662", "state": "PUBLISHED", "dateUpdated": "2026-07-29T15:16:06.092Z", "dateReserved": "2026-06-15T20:16:46.199Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-07-29T14:26:15.992Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "swagger-typescript-api", "vendor": "acacode", "versions": [{"status": "affected", "version": "< 13.12.2"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/code-gen-process.ts createApiConfig copies servers[0].url into apiConfig.baseUrl, and templates/base/http-clients/fetch-http-client.ejs interpolates apiConfig.baseUrl into the generated HttpClient baseUrl field without escaping, allowing an attacker-controlled OpenAPI spec to inject TypeScript static field code that executes when the generated fetch client module is imported. This issue is fixed in version 13.12.2."}, {"lang": "es", "value": "swagger-typescript-api genera clientes API para Fetch o Axios a partir de especificaciones OpenAPI. Antes de la versi\u00f3n 13.12.2, src/code-gen-process.ts createApiConfig copia servers[0].url en apiConfig.baseUrl, y templates/base/http-clients/fetch-http-client.ejs interpola apiConfig.baseUrl en el campo baseUrl del HttpClient generado sin escapar, permitiendo que una especificaci\u00f3n OpenAPI controlada por un atacante inyecte c\u00f3digo de campo est\u00e1tico de TypeScript que se ejecuta cuando se importa el m\u00f3dulo del cliente fetch generado. Este problema est\u00e1 solucionado en la versi\u00f3n 13.12.2."}], "id": "CVE-2026-54662", "lastModified": "2026-10-23T23:10:00.157", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 6.0, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54662", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-07-29T15:15:30.473520Z", "version": "2.0.3"}}]}, "published": "2026-07-29T15:16:25.577", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/acacode/swagger-typescript-api/commit/306d59acb8ffbb00f953f807b97234b21f51d9de"}, {"source": "security-advisories@github.com", "url": "https://github.com/acacode/swagger-typescript-api/pull/1779"}, {"source": "security-advisories@github.com", "url": "https://github.com/acacode/swagger-typescript-api/releases/tag/v13.12.2"}, {"source": "security-advisories@github.com", "url": "https://github.com/acacode/swagger-typescript-api/security/advisories/GHSA-hqj5-cw9f-rx67"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/acacode/swagger-typescript-api/security/advisories/GHSA-hqj5-cw9f-rx67"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-74"}, {"lang": "en", "value": "CWE-94"}, {"lang": "en", "value": "CWE-1336"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,13.12.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "swagger-typescript-api", "source": "cna", "vendor": "acacode"}, "product": "swagger-typescript-api", "vendor": "acacode"}], "created": "2026-07-30T14:02:19.591001+00:00", "updated": "2026-08-03T13:30:04.532262+00:00", "vendors": ["acacode", "acacode$PRODUCT$swagger-typescript-api"]}