A code injection vulnerability exists in swagger-typescript-api prior to version 13.12.2. The vulnerability resides in the axios-http-client.ejs template, which interpolates the servers[0].url value from an OpenAPI specification into the HttpClient constructor without proper escaping. An attacker who controls the OpenAPI spec can inject arbitrary code that executes when new HttpClient() or new Api() is instantiated. This represents a supply chain risk as developers consuming malicious or attacker-modified OpenAPI specs could have malicious code executed during API client generation. The issue has been patched in version 13.12.2 of the swagger-typescript-api package. Users are strongly advised to update to the fixed version immediately.