openapi-typescript-codegen Critical Code Injection Flaw Exposes Devs to Arbitrary JS Execution

The openapi-typescript-codegen library contains a critical code injection vulnerability that allows attackers to execute arbitrary JavaScript code. This flaw, identified as CVE-2026-108551, affects all versions of the tool up to and including version 0.31.0. The National Vulnerability Database assigned the issue a CVSS score of 9.3, classifying it as a critical severity threat.

At a glance

CVE

CVE-2026-108551

Product

ferdikoomen openapi-typescript-codegen

CVSS

9.3 Critical

Weakness

code injection

Exploited

No known exploitation

The vulnerability stems from improper handling of unescaped values within single-quoted string literals during code generation. According to the NVD record, attackers who can control an OpenAPI document can inject malicious JavaScript by supplying specific values. This injection occurs when generated clients are imported or when service methods are called, potentially compromising the integrity of the application using the library.

Technical Details of the Injection

The underlying weakness is categorized under CWE-94, which refers to code injection vulnerabilities. The openapi-typescript-codegen tool fails to properly escape user-supplied input when interpolating it into generated code strings. This lack of sanitization allows an attacker to break out of the intended string context using a single quote character.

Attackers can exploit this by embedding a single quote in several specific fields within the OpenAPI specification. These vulnerable fields include path keys, parameter names, the server URL located at servers[0].url, and the info.version field. When the code generator processes these manipulated fields, it creates JavaScript code that executes the attacker's payload instead of the intended logic.

Scope and Affected Versions

The vulnerability affects the openapi-typescript-codegen package maintained by developer ferdikoomen. All versions of the library up to 0.31.0 are confirmed to be vulnerable. Developers using any version prior to a potential fix remain at risk if they process untrusted OpenAPI documents.

This issue is particularly dangerous because it targets the development and build process rather than just the runtime environment. If a developer generates client code from a malicious OpenAPI specification, the resulting codebase will contain the injected JavaScript. This can lead to supply chain attacks where the malicious code is bundled into the final application.

What should you do?

Security teams should immediately audit their dependencies for openapi-typescript-codegen. Organizations should identify which projects rely on versions 0.31.0 or earlier. Until a vendor update is available, teams should restrict the source of OpenAPI documents to trusted, verified origins only.

What to do and how to stay safe: openapi-typescript-codegen

• Inventory all projects using openapi-typescript-codegen and check for versions 0.31.0 or lower.
• Restrict the generation of client code to OpenAPI documents from trusted and verified sources only.
• Monitor official channels from the maintainer ferdikoomen for a patched version or mitigation guidance.
• Review generated code outputs for unexpected JavaScript execution or unescaped string literals.

Step-by-step guide: Risk Based Vulnerability Management: Prioritize Fixes by Actual Threat

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the severity of CVE-2026-108551?

The National Vulnerability Database rates CVE-2026-108551 as critical with a CVSS score of 9.3.

Which versions of openapi-typescript-codegen are affected?

All versions of the library up to and including version 0.31.0 are affected by this vulnerability.

How can an attacker exploit this vulnerability?

Attackers can inject JavaScript by supplying unescaped values with single quotes in OpenAPI document fields like path keys or server URLs.