Summary
swagger-typescript-api trusts enum values from an OpenAPI specification and renders them directly into TypeScript templates, enabling attacker-controlled code generation.
When a malicious or compromised API spec is used as input, the generated client library can include injected code that executes as soon as the module is imported into an application.
swagger-typescript-api trusts enum values from an OpenAPI specification and renders them directly into TypeScript templates, enabling attacker-controlled code generation.
When a malicious or compromised API spec is used as input, the generated client library can include injected code that executes as soon as the module is imported into an application.
Affected context
This vulnerability arises in projects that generate TypeScript API clients using swagger-typescript-api from OpenAPI specifications that may be influenced by third parties or automated tooling.
It occurs specifically when enum values under components.schemas.*.enum are treated as trusted strings and passed through template rendering without escaping, allowing them to become executable fragments inside the generated TypeScript source.
The risk is most pronounced in environments where generated clients are built and imported without manual review, such as CI pipelines or internal code generation workflows.
This vulnerability arises in projects that generate TypeScript API clients using swagger-typescript-api from OpenAPI specifications that may be influenced by third parties or automated tooling.
It occurs specifically when enum values under components.schemas.*.enum are treated as trusted strings and passed through template rendering without escaping, allowing them to become executable fragments inside the generated TypeScript source.
The risk is most pronounced in environments where generated clients are built and imported without manual review, such as CI pipelines or internal code generation workflows.
Exploit preconditions
- Attack surface: The OpenAPI specification consumed by swagger-typescript-api (e.g., remote API docs, shared spec files, or CI inputs).
- Required access: Ability to modify or supply the OpenAPI document used for client generation (compromised spec server, poisoned repository, or manipulated input in build pipeline).
- Trigger point: Running swagger-typescript-api to generate TypeScript client code and subsequently compiling or importing the generated module.
- Why exploitation is possible: Enum values from
components.schemas.*.enumare forwarded into the TypeScript templates without proper escaping or validation, so attacker-controlled strings are interpreted as TypeScript code rather than data.
- Attack surface: The OpenAPI specification consumed by swagger-typescript-api (e.g., remote API docs, shared spec files, or CI inputs).
- Required access: Ability to modify or supply the OpenAPI document used for client generation (compromised spec server, poisoned repository, or manipulated input in build pipeline).
- Trigger point: Running swagger-typescript-api to generate TypeScript client code and subsequently compiling or importing the generated module.
- Why exploitation is possible: Enum values from
components.schemas.*.enumare forwarded into the TypeScript templates without proper escaping or validation, so attacker-controlled strings are interpreted as TypeScript code rather than data.
Why this happens
The underlying bug is a failure to treat template inputs as untrusted data when generating source code.
swagger-typescript-api passes enum entries from components.schemas.*.enum into Ts.StringValue and subsequently into EJS templates that emit TypeScript enum declarations.
Without escaping or restricting these values to safe identifier or string literal syntax, the template engine embeds arbitrary content into the generated file, mapping to CWE-94: Code Injection and CWE-74: Injection through output encoding failures.
This reflects a broader pattern where code generators and template systems forget that configuration and schema-derived values can be attacker-controlled, leading to executable payloads in otherwise trusted artifacts.
The underlying bug is a failure to treat template inputs as untrusted data when generating source code.
swagger-typescript-api passes enum entries from components.schemas.*.enum into Ts.StringValue and subsequently into EJS templates that emit TypeScript enum declarations.
Without escaping or restricting these values to safe identifier or string literal syntax, the template engine embeds arbitrary content into the generated file, mapping to CWE-94: Code Injection and CWE-74: Injection through output encoding failures.
This reflects a broader pattern where code generators and template systems forget that configuration and schema-derived values can be attacker-controlled, leading to executable payloads in otherwise trusted artifacts.
Potential impact
- Generated TypeScript clients may include arbitrary code that executes whenever the module is imported.
- Attackers could run code in developer environments, CI/CD systems, or production services that build and deploy the generated clients.
- Malicious code could exfiltrate secrets from build pipelines, environment variables, or application configuration.
- Compromised clients can alter API requests, falsify responses, or introduce backdoors and logic tampering.
- Supply-chain compromise of downstream projects that consume the generated client as a library.
- Generated TypeScript clients may include arbitrary code that executes whenever the module is imported.
- Attackers could run code in developer environments, CI/CD systems, or production services that build and deploy the generated clients.
- Malicious code could exfiltrate secrets from build pipelines, environment variables, or application configuration.
- Compromised clients can alter API requests, falsify responses, or introduce backdoors and logic tampering.
- Supply-chain compromise of downstream projects that consume the generated client as a library.
General mitigation guidance
Effective mitigation focuses on constraining and sanitizing data that flows into code generation templates and reducing trust in external specifications.
Pattern-level strategies include:
- Treat all schema-derived fields (such as enums, names, and descriptions) as untrusted input, and apply strict escaping before rendering them into source code.
- Restrict enum and identifier values to a safe, validated subset (e.g., alphanumeric plus underscores) and reject or normalize anything outside the allowed grammar.
- Separate code structure from data: use template helpers that only interpolate safe literals, not raw strings, and avoid dynamic code construction based on untrusted metadata.
- Apply defense-in-depth by reviewing generated code and enforcing policies that prevent execution of unexpected constructs in build pipelines.
- Run generation tools and compilers with least-privilege and minimize access to sensitive environment variables or credentials in case generation artifacts are tampered with.
Effective mitigation focuses on constraining and sanitizing data that flows into code generation templates and reducing trust in external specifications.
Pattern-level strategies include:
- Treat all schema-derived fields (such as enums, names, and descriptions) as untrusted input, and apply strict escaping before rendering them into source code.
- Restrict enum and identifier values to a safe, validated subset (e.g., alphanumeric plus underscores) and reject or normalize anything outside the allowed grammar.
- Separate code structure from data: use template helpers that only interpolate safe literals, not raw strings, and avoid dynamic code construction based on untrusted metadata.
- Apply defense-in-depth by reviewing generated code and enforcing policies that prevent execution of unexpected constructs in build pipelines.
- Run generation tools and compilers with least-privilege and minimize access to sensitive environment variables or credentials in case generation artifacts are tampered with.
How teams detect issues like this
Detection is generally centered around analyzing both the generator and the generated outputs for unsafe interpolation patterns.
Common approaches include:
- Static analysis rules that flag template engines or code generators inserting unescaped schema or configuration values directly into executable code constructs.
- Code review practices that inspect EJS or other templates for raw variable interpolation in locations where TypeScript or JavaScript syntax is emitted, particularly around enums and identifiers.
- Automated scanning of generated clients for suspicious constructs such as unexpected import side effects, dynamic
eval-like behavior, or out-of-place global code blocks. - Build pipeline policies that validate OpenAPI specifications against a strict schema and lint for illegal enum values or disallowed characters before running code generation.
- Leveraging generic SAST or supply-chain security tooling to monitor for changes in generation templates that could reintroduce injection risks.
Detection is generally centered around analyzing both the generator and the generated outputs for unsafe interpolation patterns.
Common approaches include:
- Static analysis rules that flag template engines or code generators inserting unescaped schema or configuration values directly into executable code constructs.
- Code review practices that inspect EJS or other templates for raw variable interpolation in locations where TypeScript or JavaScript syntax is emitted, particularly around enums and identifiers.
- Automated scanning of generated clients for suspicious constructs such as unexpected import side effects, dynamic
eval-like behavior, or out-of-place global code blocks. - Build pipeline policies that validate OpenAPI specifications against a strict schema and lint for illegal enum values or disallowed characters before running code generation.
- Leveraging generic SAST or supply-chain security tooling to monitor for changes in generation templates that could reintroduce injection risks.
