{"id":"CVE-2026-54666","summary":"swagger-typescript-api vulnerable to code injection via unescaped OpenAPI path strings in generated method bodies","details":"swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, src/schema-routes/schema-routes.ts passes OpenAPI path keys through parseRouteName to templates/default/procedure-call.ejs and templates/modular/procedure-call.ejs without escaping JavaScript template literal interpolation, allowing an attacker-controlled path containing ${...} to execute when the generated method is called. This issue is fixed in version 13.12.2.","aliases":["GHSA-w284-33mx-6g9v"],"modified":"2026-07-31T03:48:46.771044794Z","published":"2026-07-29T14:34:48.668Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54666.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-1336","CWE-74","CWE-94"]},"references":[{"type":"WEB","url":"https://github.com/acacode/swagger-typescript-api/releases/tag/v13.12.2"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54666.json"},{"type":"ADVISORY","url":"https://github.com/acacode/swagger-typescript-api/security/advisories/GHSA-w284-33mx-6g9v"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54666"},{"type":"FIX","url":"https://github.com/acacode/swagger-typescript-api/commit/306d59acb8ffbb00f953f807b97234b21f51d9de"},{"type":"FIX","url":"https://github.com/acacode/swagger-typescript-api/pull/1779"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/acacode/swagger-typescript-api","events":[{"introduced":"0"},{"fixed":"306d59acb8ffbb00f953f807b97234b21f51d9de"},{"fixed":"cc3e4d1598dfd990b8d862b88cd64ae1ca7653e3"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"13.12.2"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["v13.12.1","v13.12.0","v13.11.2","v13.11.1","v13.11.0","v13.10.0","v13.9.3","v13.9.2","v13.9.1","v13.9.0","v13.8.0","v13.7.2","v13.7.1","v13.7.0","v13.6.11","v13.6.10","v13.6.9","v13.6.8","v13.6.7","v13.6.6","v13.6.5","v13.6.4","v13.6.3","v13.6.2","v13.6.0","v13.5.0","v13.4.0","v13.3.1","v13.3.0","v13.2.18","13.2.17","13.2.16","13.2.15","13.2.14","13.2.13","13.2.12","13.2.11","13.2.10","13.2.9","13.2.8","13.2.7","13.2.6","13.2.5","13.2.4","13.2.3","13.2.2","13.2.1","13.2.0","13.1.3","13.1.2","13.1.1","13.1.0","13.0.28","13.0.27","13.0.26","13.0.25","13.0.24","13.0.22","13.0.21","13.0.20","13.0.19","13.0.18","13.0.17","13.0.16","13.0.15","13.0.14","13.0.13","13.0.12","13.0.11","13.0.10","13.0.9","13.0.8","13.0.7","13.0.6","13.0.5","13.0.4","13.0.3","13.0.2","13.0.1","13.0.0","12.0.4","12.0.3","12.0.2","12.0.1","12.0.0","11.1.3","11.1.2","11.1.1","11.1.0","11.0.0","10.0.3","10.0.2","9.2.0","9.1.2","9.1.1","9.0.2","9.0.1","9.0.0","8.0.3","8.0.2","8.0.1","8.0.0","7.0.1","7.0.0","6.4.2","6.4.1","6.4.0","6.3.0","6.2.1","6.2.0","6.1.2","6.1.1","6.1.0","6.0.0","5.1.7","5.1.6","5.1.5","5.1.4","5.1.3","5.1.2","5.1.1","5.1.0","5.0.0","4.4.0","4.3.0","4.2.0","4.1.0","4.0.5","4.0.4","4.0.3","4.0.2","4.0.1","4.0.0","3.1.2","3.1.1","3.1.0","3.0.0","2.0.0","1.12.0","1.11.0","1.10.0","1.8.4","1.8.3","1.8.2","1.8.1","1.8.0","1.7.2","1.7.0","1.6.3","1.6.2","1.6.1","1.6.0","1.4.0","1.2.6"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54666.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H"}]}