THREAT OPS › Threat News › [GHSA] GHSA-5f94-x226-ccpm (high) — swagger-typescript-api vulnerable to code injection via unescaped enum string values
[GHSA] GHSA-5f94-x226-ccpm (high) — swagger-typescript-api vulnerable to code injection via unescaped enum string values
GHSA-5f94-x226-ccpm Severity: high CVE: CVE-2026-54664
swagger-typescript-api vulnerable to code injection via unescaped enum string values
### Summary
`swagger-typescript-api` interpolates `components.schemas.*.enum[i]` string values into the body of generated TypeScript `enum` declarations without escaping. A malicious enum value can close the enclosing string literal, terminate the enum body
MITRE ATT&CK techniques
- JavaScriptT1059.007
Indicators of compromise
- CVE-2026-54664cve
- https://attacker.example/openapi.json`url
Original source: https://github.com/advisories/GHSA-5f94-x226-ccpm