The vulnerable code is located in the axios-http-client.ejs template used by swagger‑typescript‑api to generate API clients. It injects the value of servers[0].url directly into the HttpClient constructor without escaping. An attacker who can supply a malicious OpenAPI specification can embed executable code in this URL field, causing that code to run whenever the generated client is instantiated. This leads to arbitrary code execution, a serious remote code execution vulnerability.

The issue affects acacode’s Swagger TypeScript API, specifically the Axios HTTP client templates. All releases earlier than version 13.12.2 are vulnerable; the problem was fixed in v13.12.2 and later versions provide proper escaping of the URL field.

The CVSS base score of 8.3 indicates a high severity. The EPSS score is less than 1%, suggesting low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is the code‑generation phase, requiring an attacker to supply a crafted OpenAPI spec that the build process or developer uses to create a client. Once executed, the injected code runs with the privileges of the process creating the client. Though the exploitation surface is limited to environments that generate clients from untrusted specs, once triggered the impact is full local or remote code execution within that environment.