swagger-typescript-api generates API clients from an OpenAPI Specification. The code generator did not escape JavaScript template literal placeholders when incorporating OpenAPI path strings into generated method bodies. An attacker who controls or injects a path containing a ${…} expression can cause that code to be evaluated during method execution, allowing arbitrary JavaScript execution.

The vendor is acacode, product swagger-typescript-api. Versions up to and including 13.12.1 are affected. The vulnerability is fixed in release 13.12.2 and later.

The CVSS score of 8.3 classifies the flaw as high severity. The EPSS score of less than 1% indicates a very low exploitation probability at the time of analysis, and the vulnerability is not listed in CISA KEV. Exploitation requires an attacker to supply a malicious OpenAPI specification to the code generator, so it typically operates in the development or build environment. The injected code executes within the context of the generated client when its methods are called, which can lead to remote code execution on the developer's machine or in a browser environment that consumes the client.