CVE-2026-54661 HIGH

CVE-2026-54661: swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in axios http-client template

Vendor Acacode
Product swagger-typescript-api
Weakness CWE-74
Published July 29, 2026
Last update July 29, 2026
View on NVD All CVEs

CVSS base score

8.3/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction Required
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, templates/base/http-clients/axios-http-client.ejs interpolates servers[0].url from src/code-gen-process.ts into the HttpClient constructor without escaping, allowing an attacker-controlled OpenAPI spec to inject code that executes when new HttpClient() or new Api() is constructed. This issue is fixed in version 13.12.2.

Key dates

02Disclosure timeline

July 29, 2026 CVE published
July 29, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2019-25150 Email Templates <= 1.3 - HTML Injection CVE-2022-21663 Authenticated Object Injection in Multisites in WordPress CVE-2026-5797 Quiz and Survey Master (QSM) <= 11.1.0 - Unauthenticated Shortcode Injection Leading to Arbitrary Quiz Result Disclosure via Quiz Answer Text Input Fields CVE-2024-1128 Tutor LMS <= 2.6.0 - Authenticated(Student+) HTML Injection via Q&A CVE-2023-6164 MainWP Dashboard <= 4.5.1.2 - Authenticated(Administrator+) CSS Injection