Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability lies in the swagger-typescript-api library, specifically in how it handles OpenAPI path strings during code generation. The provided vulnerability description clearly points out that the parseRouteName function in src/schema-routes/schema-routes.ts is responsible for processing these paths. The vulnerability occurs because this function fails to escape special characters used in JavaScript template literals (${...}).
The provided commit 306d59acb8ffbb00f953f807b97234b21f51d9de confirms this analysis. The changes in src/schema-routes/schema-routes.ts show that the routeName is now passed through a newly added escaping function, escapeJsTemplateLiteralStatic, before it is further processed. This prevents the injection of malicious code. The vulnerable function is therefore SchemaRoutes.parseRouteName, as it was the one that directly used the unescaped, potentially malicious, input (routeName) which was then used to generate vulnerable code.
SchemaRoutes.parseRouteNamesrc/schema-routes/schema-routes.ts
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| swagger-typescript-api | npm | <= 13.12.1 | 13.12.2 |