CVE-2026-108551

Name of the Vulnerable Software and Affected Versions openapi-typescript-codegen versions prior to 0.31.1

Description Code injection occurs when the software processes an OpenAPI document containing unescaped values interpolated into single-quoted string literals. An attacker controlling the OpenAPI specification can inject arbitrary JavaScript by embedding single quotes in path keys, parameter names, servers[0].url, or info.version. This malicious code may execute when the generated clients are imported or when specific service methods are called, potentially compromising applications and CI pipelines.

Recommendations Stop processing untrusted OpenAPI specifications. Audit existing generated clients and restrict CI inputs. At the moment, there is no information about a newer version that contains a fix for this vulnerability.