A high-severity code injection vulnerability in the swagger-typescript-api package may allow unauthenticated attackers to execute arbitrary code via malicious OpenAPI specifications.

This flaw involves improper neutralization of special elements used in template engines and code generation (CWE-74, CWE-94, CWE-1336). It allows an unauthenticated attacker to inject malicious code during the API client generation process.

Successful exploitation allows an attacker to execute arbitrary code, which could compromise the security of build systems and downstream applications. The CVSS score of 8.3 underscores the high risk of this vulnerability to organizational infrastructure and code integrity.

Immediate Action: Update the npm package swagger-typescript-api to version 13.12.2 or later.

Proactive Monitoring: Monitor build server logs and file system integrity for unauthorized changes to generated TypeScript files.

Compensating Controls: Use static analysis tools to verify the integrity of generated code and ensure that OpenAPI definitions are sourced from trusted, internal origins only.

Public Exploit Available: Unknown.

Given the potential for code injection and the critical role of API client generation in modern software development, users should treat this as a high-priority update. Patching to the latest version is the only definitive way to eliminate the vulnerability.