{"id":"CVE-2026-108551","published":"2026-10-10T15:16:58.273","lastModified":"2026-10-16T19:21:14.417","description":"openapi-typescript-codegen through 0.31.0 contains a code injection vulnerability that allows attackers controlling an OpenAPI document to inject JavaScript by supplying unescaped values interpolated into single-quoted string literals. Attackers can embed a single quote in path keys, parameter names, servers[0].url, or info.version to execute arbitrary JavaScript when generated clients are imported or service methods called.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-94"],"vendors":[],"products":[],"references":[{"url":"https://github.com/ferdikoomen/openapi-typescript-codegen","tags":[]},{"url":"https://github.com/ferdikoomen/openapi-typescript-codegen/blob/v0.31.0/src/templates/core/OpenAPI.hbs#L20-L23","tags":[]},{"url":"https://github.com/ferdikoomen/openapi-typescript-codegen/blob/v0.31.0/src/templates/exportService.hbs#L89-L110","tags":[]},{"url":"https://github.com/ferdikoomen/openapi-typescript-codegen/issues/2809","tags":[]},{"url":"https://www.vulncheck.com/advisories/openapi-typescript-codegen-through-0.31.0-code-injection-via-handlebars-templates","tags":[]}],"exploitRefs":[{"url":"https://github.com/ferdikoomen/openapi-typescript-codegen","tags":[]},{"url":"https://github.com/ferdikoomen/openapi-typescript-codegen/blob/v0.31.0/src/templates/core/OpenAPI.hbs#L20-L23","tags":[]},{"url":"https://github.com/ferdikoomen/openapi-typescript-codegen/blob/v0.31.0/src/templates/exportService.hbs#L89-L110","tags":[]},{"url":"https://github.com/ferdikoomen/openapi-typescript-codegen/issues/2809","tags":[]}],"hasPoc":true,"ai":{"summary":"The vulnerability allows attackers to inject arbitrary JavaScript code into generated OpenAPI client code by manipulating unescaped values in single-quoted string literals within OpenAPI documents. This can lead to remote code execution when the generated clients are imported or used.","exploitability":"Exploitation is relatively straightforward as attackers only need to control an OpenAPI document with unescaped single quotes in path keys, parameter names, server URLs, or version fields to inject JavaScript code that executes during client usage.","blast_radius":"The impact could be significant across any application using generated clients from vulnerable OpenAPI documents, potentially affecting multiple services and users who import or call those clients.","remediation":"Upgrade to openapi-typescript-codegen 0.31.1 or later to fix the code injection vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["code-injection","api","client-side","javascript"],"model":"garnet-coder","analyzedAt":"2026-10-12T08:45:50.495Z"}}