Security Advisory

CVE-2026-54666

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-07-29 14:34:48

Last updated 2026-07-29 14:34:48

Assigner GitHub_M

CVSS score not scored

State PUBLISHED

Description

swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, src/schema-routes/schema-routes.ts passes OpenAPI path keys through parseRouteName to templates/default/procedure-call.ejs and templates/modular/procedure-call.ejs without escaping JavaScript template literal interpolation, allowing an attacker-controlled path containing ${...} to execute when the generated method is called. This issue is fixed in version 13.12.2.

← Browse all CVEs View on cve.org ↗