A high-severity code injection vulnerability in the swagger-typescript-api package may allow unauthenticated attackers to execute arbitrary code via malicious OpenAPI specifications.

This vulnerability is caused by improper neutralization of special elements during code generation (CWE-74, CWE-94, CWE-1336). An unauthenticated attacker can leverage this to inject arbitrary commands into the output generated by the tool.

Exploitation of this vulnerability could lead to arbitrary code execution, providing an attacker with a foothold in the development environment. The CVSS score of 8.3 indicates a serious threat that could compromise the confidentiality and integrity of generated API clients.

Immediate Action: Update the npm package swagger-typescript-api to version 13.12.2 or later.

Proactive Monitoring: Conduct regular reviews of generated code and monitor for any unusual characters or structures that deviate from standard API specifications.

Compensating Controls: Restrict the execution of the API generation tool to isolated, low-privilege build containers to minimize the impact of potential code injection.

Public Exploit Available: Unknown.

Security teams should enforce the immediate adoption of the patched version 13.12.2. Ensuring that build tools are updated is essential to maintaining a secure supply chain and preventing malicious code from being integrated into production environments.