The flaw resides in the schema-parser module of swagger-typescript-api, where enum string values from an OpenAPI specification are directly interpolated into TypeScript enum definitions without escaping. An attacker who can supply a malicious OpenAPI spec can inject arbitrary JavaScript/TypeScript code that executes when the generated client module is imported, leading to remote code execution and a complete compromise of the runtime environment. The weakness is an example of uncontrolled code generation (CWE-1336, CWE-74, CWE-94).

The issue affects the acacode:swagger-typescript-api library in all releases prior to v13.12.2. Users who generate API client code using versions earlier than 13.12.2 ingest unsanitized enum definitions. Upgrading to v13.12.2 or later removes the vulnerability. Packages spawned from older versions remain affected until they are regenerated with a fixed library.

The CVSS score of 8.3 classifies this as critical. However, the EPSS score is below 1% and the vulnerability is not listed in CISA’s KEV, indicating that exploit attempts are unlikely in the wild. Attacking requires the ability to influence the OpenAPI spec used by the generator; thus, the attack surface is limited to environments where developers or build systems import generated clients without validating the spec. The final code execution occurs only when the module is imported into a running JavaScript environment.