swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, src/schema-routes/schema-routes.ts passes OpenA…

A code injection vulnerability exists in swagger-typescript-api prior to version 13.12.2. The library, which generates API clients for Fetch or Axios from OpenAPI Specifications, fails to escape JavaScript template literal interpolation when processing OpenAPI path keys. Specifically, src/schema-routes/schema-routes.ts passes path keys through parseRouteName to EJS templates without sanitization. An attacker-controlled OpenAPI path containing ${...} expressions can achieve arbitrary code execution when the generated API method is invoked. This represents a supply chain risk as the malicious payload is embedded at code generation time and triggers at runtime. The vulnerability is fixed in version 13.12.2 of swagger-typescript-api.