AIKIDO-2026-11118

TL;DR

swagger-typescript-api interpolates OpenAPI path strings raw into JavaScript template literals in its generated API method bodies without neutralizing ${ } syntax. A path key containing template-literal expressions survives route-name preprocessing and becomes live code in the generated method. Calling an affected method generated from an attacker-controlled spec evaluates the injected expression with the host process privileges on every call. The fix escapes path strings for template-literal insertion while preserving deliberate declared path-parameter interpolations.