Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| swagger-typescript-api | npm | <= 13.12.1 | 13.12.2 |
Miggo AIRoot Cause AnalysisThe vulnerability exists in the code generated by swagger-typescript-api when using the axios HTTP client. The root cause is the improper handling of the servers[0].url field from an OpenAPI specification. This URL is directly interpolated into the generated HttpClient's constructor as a string literal without proper escaping.
The analysis of the provided commit 306d59acb8ffbb00f953f807b97234b21f51d9de confirms this. The patch introduces a new utility function escapeJsStringLiteral and applies it to the serverUrl within the CodeGenProcess.createApiConfig method in src/code-gen-process.ts. This function is responsible for preparing the data that gets passed to the EJS templates for code generation.
When an attacker controls the OpenAPI specification, they can craft a malicious servers[0].url value. This value can contain characters like " to close the string literal, followed by arbitrary JavaScript code. A common technique, as described in the vulnerability details, is to use a computed property with an Immediately Invoked Function Expression (IIFE) to execute code. This malicious code gets executed every time an instance of the generated HttpClient is created.
Therefore, the primary vulnerable function that would appear in a runtime profile during exploitation is the constructor of the generated HttpClient class. The CodeGenProcess.createApiConfig function is also listed as it is the source of the vulnerability in the generator tool itself, and its modification is the evidence of the fix.
HttpClient.constructortemplates/base/http-clients/axios-http-client.ejs
CodeGenProcess.createApiConfigsrc/code-gen-process.ts