AIKIDO-2026-11121

TL;DR

swagger-typescript-api emits TypeScript enum declarations from OpenAPI specifications and wraps enum string values in double quotes without escaping them. A malicious spec can break out of the enum value string literal and inject a bare-block immediately-invoked function expression. Importing the generated module produced from an attacker-controlled spec executes the injected code at module load with the host process privileges, without any instantiation. The fix escapes enum string values before emitting them.