A high-severity code injection vulnerability in the swagger-typescript-api package may allow unauthenticated attackers to execute arbitrary code via malicious OpenAPI specifications.

This vulnerability involves improper neutralization of special elements in code generation and template engines (CWE-74, CWE-94, CWE-1336). It allows an unauthenticated attacker to inject malicious payloads into generated API client code.

Successful exploitation permits an attacker to achieve code execution within the environment where the client generation occurs. Given the CVSS score of 8.3, this represents a significant risk to the integrity and availability of development and build pipelines, potentially leading to supply chain compromise.

Immediate Action: Update the npm package swagger-typescript-api to version 13.12.2 or later.

Proactive Monitoring: Audit CI/CD pipeline logs for unexpected execution patterns or anomalous modifications to generated client files.

Compensating Controls: Implement strict input validation on all OpenAPI specifications processed by the tool to ensure they conform to expected schemas and do not contain malicious characters.

Public Exploit Available: Unknown.

The severity of this flaw necessitates immediate attention to prevent potential downstream supply chain attacks. Organizations using this tool for automated client generation must prioritize updating to version 13.12.2 across all development environments and build servers.