Key points
- CVE-2026-108551 is rated CVSS 9.3 Critical by the National Vulnerability Database.
- Attackers can inject JavaScript by embedding single quotes in OpenAPI document fields.
- The flaw affects openapi-typescript-codegen versions through 0.31.0.
The short version
- The vulnerability allows arbitrary JavaScript execution when generated clients are imported.
- Exploitation requires an attacker to control the input OpenAPI specification document.
- Affected fields include path keys, parameter names, server URLs, and version strings.
The details
The National Vulnerability Database lists CVE-2026-108551 as a critical security flaw in the openapi-typescript-codegen library. The vulnerability carries a CVSS score of 9.3, indicating severe risk. The issue stems from improper handling of unescaped values within single-quoted string literals during code generation. According to the NVD record, the weakness is classified as CWE-94, which relates to code injection.
The flaw exists in all versions of openapi-typescript-codegen up to and including 0.31.0. Developers using these versions to generate TypeScript clients from OpenAPI specifications are exposed to this risk. The library fails to sanitize specific input fields before interpolating them into generated code. This lack of sanitization allows malicious payloads to be embedded directly into the source code. When the generated client is imported or service methods are called, the injected JavaScript executes.
The context
Attackers can exploit this vulnerability by supplying a crafted OpenAPI document. The document must contain specific fields with embedded single quotes to break out of string literals. According to the NVD description, vulnerable fields include path keys, parameter names, servers[0].url, and info.version. An attacker controlling the OpenAPI document can inject arbitrary JavaScript code.
This code runs in the context of the application importing the generated client. The vulnerability affects the build or runtime phase depending on how the generated code is utilized. It does not require network access to the target system if the malicious document is part of the build process. The flaw highlights risks in automated code generation tools that trust external specifications.
What should you do?
Developers should audit their projects for usage of openapi-typescript-codegen versions 0.31.0 or earlier. Teams should verify the integrity of all OpenAPI documents used in generation pipelines. Organizations should monitor for any confirmed patches or version updates from the vendor. Security teams should review generated code for unexpected JavaScript execution patterns.
What to do and how to stay safe: openapi-typescript-codegen
- Check project dependencies for openapi-typescript-codegen versions up to 0.31.0 and isolate affected builds.
- Validate all incoming OpenAPI specifications against a strict schema to reject unexpected characters or structures.
- Monitor runtime logs for unusual JavaScript execution or unexpected network calls from generated clients.
- Review build processes to ensure only trusted, verified OpenAPI documents are used for code generation.
Step-by-step guide: Automatic Software Updates: 8 FAQs on Security and Risk
General security guidance from the DataSafe Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVE ID for this vulnerability?
The vulnerability is identified as CVE-2026-108551 in the National Vulnerability Database.
Which versions of openapi-typescript-codegen are affected?
All versions of openapi-typescript-codegen through 0.31.0 are affected by this code injection flaw.
How can an attacker exploit this vulnerability?
Attackers can embed single quotes in OpenAPI fields like path keys or server URLs to inject JavaScript.
