CyberRota Analysis
AI-GeneratedThe swagger-typescript-api tool, prior to version 13.12.2, is vulnerable due to improper escaping of the server URL in the HttpClient constructor, allowing for potential code injection via an attacker-controlled OpenAPI specification. This vulnerability can lead to remote code execution when new instances of HttpClient or Api are created. Organizations using this tool should prioritize updating to version 13.12.2 to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, templates/base/http-clients/axios-http-client.ejs interpolates servers[0].url from src/code-gen-process.ts into the HttpClient constructor without escaping, allowing an attacker-controlled OpenAPI spec to inject code that executes when new HttpClient() or new Api() is constructed. This issue is fixed in version 13.12.2.