CVE-2026-108551: openapi-typescript-codegen through 0.31.0 Code Injection via Handlebars Templates
openapi-typescript-codegen through 0.31.0 contains a code injection vulnerability that allows attackers controlling an OpenAPI document to inject JavaScript by supplying unescaped values interpolated into single-quoted string literals. Attackers can embed a single quote in path keys, parameter names, servers[0].url, or info.version to execute arbitrary JavaScript when generated clients are imported or service methods called.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Teams that generate clients with openapi-typescript-codegen through 0.31.0 from an OpenAPI document an attacker can control are exposed. The injected JavaScript executes in the environment where the generated client is imported or where affected service methods are called.
What does an attacker need to exploit it?
An attacker needs control over values in the OpenAPI document. Exploitable fields include path keys, parameter names, servers[0].url, and info.version, where a single quote can be used to break out of generated single-quoted JavaScript string literals.
Does exploitation require authentication or user interaction?
No. The supplied vector indicates network-based exploitation with low complexity, no privileges required, and no user interaction required; the prerequisite is that the attacker can influence the OpenAPI document used for generation.
How can we tell whether generated code may be affected?
Review OpenAPI documents used with affected versions for untrusted or unexpected single quotes in path keys, parameter names, servers[0].url, and info.version. Also inspect generated clients for unexpected JavaScript within the corresponding generated string values.