AIKIDO-2026-11119

TL;DR

swagger-typescript-api interpolates the OpenAPI servers[0].url value raw into the string literal of its generated fetch HTTP client template without escaping it. A malicious specification can break out of the string literal and inject TypeScript that runs as a static class field initializer. Simply importing the generated module produced from an attacker-controlled spec executes the injected code with the host process privileges, without any instantiation or method call. The fix escapes the base URL once at the source before template rendering.