Key points
- openapi-typescript-codegen versions through 0.31.0 contain a critical code injection flaw.
- Attackers exploit single quotes in path keys or parameter names to inject JavaScript.
- The vulnerability is rated CVSS 9.3 and allows remote code execution when clients are imported.
The openapi-typescript-codegen tool contains a critical security flaw that allows attackers to inject arbitrary JavaScript into generated client code. According to the National Vulnerability Database, versions of the tool up to and including 0.31.0 are affected by this issue, which is tracked as CVE-2026-108551. The vulnerability enables remote code execution when generated clients are imported or when service methods are called, posing a significant risk to development environments.
By the numbers
- CVSS 9.3: The severity score assigned to CVE-2026-108551, indicating a critical risk level.
- 0.31.0: The highest version of openapi-typescript-codegen confirmed to be affected by this vulnerability.
- CWE-94: The Common Weakness Enumeration identifier for code injection, the underlying weakness class.
What the figures mean
The CVSS 9.3 rating reflects the high potential for damage when an attacker controls the input data. According to NVD records, the flaw arises because the tool interpolates unescaped values into single-quoted string literals during code generation. Attackers can embed a single quote in specific fields such as path keys, parameter names, servers[0].url, or info.version within an OpenAPI document. When a developer generates a client from such a malicious document, the injected JavaScript executes automatically.
This mechanism turns a standard code generation step into a vector for arbitrary code execution. The NVD description notes that the injection occurs when the generated clients are imported or when service methods are invoked. This means the impact is immediate upon usage of the generated code, rather than requiring additional user interaction beyond the initial import. The vulnerability affects the ferdikoomen openapi-typescript-codegen package, which is widely used for creating TypeScript clients from OpenAPI specifications.
What should you do?
Managed service providers should audit their client environments for usage of openapi-typescript-codegen. Teams need to check the version of the tool in their project dependencies and compare it against the affected range. If the version is 0.31.0 or lower, the environment is vulnerable to code injection attacks. Organizations should restrict access to OpenAPI documents from untrusted sources to reduce the risk of malicious input.
What to do and how to stay safe: openapi-typescript-codegen
- Review project dependencies to identify if openapi-typescript-codegen is installed and check its version number.
- Restrict the generation of client code to OpenAPI documents from trusted and verified internal sources only.
- Monitor generated client files for unexpected JavaScript code or syntax anomalies that indicate injection.
- Wait for the vendor to release a patched version before updating, as no fix has been confirmed yet.
General security guidance from the BitShield News newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of openapi-typescript-codegen are vulnerable to CVE-2026-108551?
All versions of openapi-typescript-codegen up to and including 0.31.0 are affected by this vulnerability.
How do attackers exploit this code injection flaw?
Attackers embed single quotes in OpenAPI document fields like path keys or parameter names to inject JavaScript.
What is the CVSS score for this vulnerability?
The National Vulnerability Database rates CVE-2026-108551 with a CVSS score of 9.3, which is critical.
