Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, src/schema-routes/schema-routes.ts passes OpenAPI path keys through parseRouteName to templates/default/procedure-call.ejs and templates/modular/procedure-call.ejs without escaping JavaScript template literal interpolation, allowing an attacker-controlled path containing ${...} to execute when the generated method is called. This issue is fixed in version 13.12.2.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
NONE
I got six CVEs in a major npm package including 4 RCEs. CVE-2026-54662, CVE-2026-54661, CVE-2026-54666, CVE-2026-54664, CVE-2026-54660, CVE-2026-54663 Full writeup with every sink and payload here: https://thegriffyn.me/blog/oss/six-cves-in-swagger-typescript-api #infosec #cybersecurity #rce
Post summary
The author reveals six CVEs in a major npm package, details four RCE vulnerabilities, and links to a writeup providing sinks and payloads.