swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, src/schema-parser/base-schema-parsers/enum.ts p…

A code injection vulnerability exists in swagger-typescript-api prior to version 13.12.2. The flaw resides in how enum values from OpenAPI specification components are passed to the TypeScript string value handler without proper escaping before being rendered into TypeScript enum declarations via an EJS template. An attacker who controls an OpenAPI specification file can inject arbitrary code that executes when the generated TypeScript module is imported. The vulnerability affects the src/schema-parser/base-schema-parsers/enum.ts and src/configuration.ts files. The issue has been assigned CVE-2026-54664 and is fixed in version 13.12.2. Users are advised to upgrade immediately to the patched version to mitigate the risk of supply chain code injection attacks.