A code injection vulnerability in swagger-typescript-api allows for the execution of arbitrary code during the generation of API clients.

This is an injection vulnerability (CWE-74, CWE-94, CWE-1336) occurring within the template engine. It involves unauthenticated interaction during the API client generation process.

The CVSS score of 8.3 indicates a high risk, particularly for CI/CD pipelines that utilize this tool. If an attacker can influence the OpenAPI Specification, they may be able to inject malicious code into the generated API clients, leading to supply chain compromise or remote code execution within development and production environments.

Immediate Action: Update the npm package swagger-typescript-api to version 13.12.2 or higher.

Proactive Monitoring: Audit CI/CD pipeline logs and generated client source code for unexpected or unauthorized code structures.

Compensating Controls: Implement input validation for all OpenAPI specifications processed by automated tools to ensure they do not contain malicious payloads.

Public Exploit Available: Unknown

Given the potential for code injection within the software supply chain, organizations should immediately update their dependencies to the latest version. Verifying the integrity of OpenAPI specifications used in generation workflows remains a critical secondary defense.