swagger-typescript-api, an open source tool that generates API clients for Fetch or Axios, contains a code injection vulnerability in versions before 13.12.2. The generator copies the first server URL from the OpenAPI specification into a configuration variable and then directly interpolates that value into the generated TypeScript source for the HTTP client. Because the URL is not escaped, an attacker who can supply a malicious OpenAPI specification can embed arbitrary TypeScript code into the client module, which will be executed when the module is imported. This flaw allows remote code execution on any system that compiles or runs the generated client, with full privileges of the process that imports it. The weakness aligns with CWE-1336 (Code Injection), CWE-74 (Improper Sanitization of String), and CWE-94 (Improper Control of Generation of Code).

All releases of acacode swagger-typescript-api prior to v13.12.2 are affected. The issue is fixed in version 13.12.2 and later, so any project using an older version of swagger-typescript-api should consider updating immediately.

The CVSS score of 8.3 signals a high severity vulnerability, yet the EPSS score of less than 1% indicates a low likelihood of public exploitation at present. Because the flaw requires control over the OpenAPI specification that is passed to the generator, it most likely targets code‑generation pipelines or development environments where an attacker can inject malicious content. The vulnerability is not listed in CISA’s KEV catalog, and no public exploits are reported. Nevertheless, the potential for executing arbitrary code upon client import makes it a critical concern for any project that processes untrusted specifications.