THREAT OPS › Threat News › [GHSA] GHSA-w284-33mx-6g9v (high) — swagger-typescript-api vulnerable to code injection via unescaped OpenAPI path strings in generated method bodies
[GHSA] GHSA-w284-33mx-6g9v (high) — swagger-typescript-api vulnerable to code injection via unescaped OpenAPI path strings in generated method bodies
GHSA-w284-33mx-6g9v Severity: high CVE: CVE-2026-54666
swagger-typescript-api vulnerable to code injection via unescaped OpenAPI path strings in generated method bodies
### Summary
`swagger-typescript-api` interpolates OpenAPI path strings (the keys of the `paths` object, e.g. `/users/{id}`) directly into a JavaScript template literal inside the body of every generated API method, without escap
MITRE ATT&CK techniques
- JavaScriptT1059.007
Indicators of compromise
- CVE-2026-54666cve
- https://attacker.example/openapi.json`url
Original source: https://github.com/advisories/GHSA-w284-33mx-6g9v