CVE-2026-108551 in openapi-typescript-codegen
Summary
by MITRE • 10/10/2026
openapi-typescript-codegen through 0.31.0 contains a code injection vulnerability that allows attackers controlling an OpenAPI document to inject JavaScript by supplying unescaped values interpolated into single-quoted string literals. Attackers can embed a single quote in path keys, parameter names, servers[0].url, or info.version to execute arbitrary JavaScript when generated clients are imported or service methods called.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/10/2026
The vulnerability identified within openapi-typescript-codegen versions up to 0.31.0 represents a critical code injection flaw rooted in improper input validation and sanitization during the template rendering process. This software tool is designed to generate TypeScript client libraries from OpenAPI specifications, automating the creation of API interaction code for developers. The core issue arises when the generator processes specific fields within an OpenAPI document that are interpolated directly into single-quoted string literals within the generated JavaScript or TypeScript source files without adequate escaping mechanisms. Because the generation process assumes a level of trust in the input schema structure, it fails to sanitize characters that have special meaning in string contexts, specifically the single quote character. This oversight creates a pathway for malicious actors who possess control over the OpenAPI document definition to inject arbitrary code into the resulting client library.
From a technical perspective, the flaw operates through several distinct entry points within the OpenAPI specification structure. Attackers can exploit this vulnerability by embedding unescaped single quotes in path keys, parameter names, server URLs defined under servers[0].url, or even metadata fields such as info.version. When openapi-typescript-codegen processes these inputs, it constructs string literals using template interpolation that does not escape the embedded quote. Consequently, when the generated code is executed by a JavaScript runtime environment like Node.js or interpreted in a browser context, the injected single quote terminates the intended string literal prematurely. This allows any subsequent content within the specification to be parsed as executable code rather than data. For instance, if an attacker injects a payload that includes closing brackets and semicolons followed by malicious script logic, the runtime will execute this logic immediately upon import or invocation of the generated service methods.
The operational impact of this vulnerability is severe due to its potential for Remote Code Execution (RCE). Since openapi-typescript-codegen is often used in automated build pipelines and development workflows, a compromised OpenAPI document can lead to the generation of malicious client code that gets distributed to end-users or integrated into production systems. If these generated clients are imported by an application, the injected JavaScript executes automatically during module initialization or when specific API endpoints are accessed. This execution occurs within the context of the user running the application, potentially granting attackers access to sensitive data stored in local storage or cookies, session hijacking capabilities, and the ability to perform actions on behalf of the victim. In server-side environments using Node.js, this could escalate to full system compromise depending on the permissions under which the application runs.
This vulnerability aligns with CWE-94 Improper Control of Generation of Code (Code Injection), specifically where untrusted data is used as code without proper neutralization. It also maps closely to ATT&CK technique T1059 Command and Scripting Interpreter, particularly sub-techniques involving JavaScript or TypeScript execution. The attack vector leverages the trust relationship between developers who rely on automated tools for boilerplate generation and the integrity of their API specifications. Often, OpenAPI documents are sourced from third-party providers or internal teams that may not have rigorous security review processes in place, making this a significant supply chain risk.
Mitigation strategies must focus on both immediate patching and long-term defensive coding practices. The primary remediation is to upgrade openapi-typescript-codegen to version 0.32.0 or later, where the developers have implemented proper escaping for string literals during code generation. For organizations unable to update immediately, it is critical to implement strict validation of OpenAPI documents before they are processed by the generator. This includes sanitizing input fields such as path parameters, query strings, and server URLs to ensure no single quotes or other special characters that could break out of string contexts are present. Additionally, developers should consider using Content Security Policy (CSP) headers in web applications consuming these generated clients to restrict script execution sources, although this is a compensating control rather than a fix for the root cause. Regular auditing of third-party dependencies and their configurations is essential to prevent similar injection vulnerabilities from being introduced into software supply chains through automated tooling.