openapi-typescript-codegen CVE-2026-108551

Exploitation requires that the victim generate a TypeScript client with openapi-typescript-codegen (version <=0.31.0) from an OpenAPI document that is wholly or partly attacker-controlled, and then import the generated code or call a generated service method. The concrete injection points named in the description are path keys, parameter names, servers[0].url, and info.version - any of which, if containing an unescaped single quote plus JavaScript, breaks out of a single-quoted string literal in the Handlebars-generated output. Limiting factors: the attacker must be able to influence the OpenAPI spec consumed at generation time (e.g. third-party, public, or user-submitted specs), and a build/generation step followed by import or invocation must occur - purely trusted, first-party specs are not exposed. There is no runtime network-service exposure; this is a build-time/supply-chain code-execution condition against environments that generate clients from untrusted API definitions.

This is a CWE-94 code-injection flaw in openapi-typescript-codegen (through 0.31.0), a developer code-generation library, carrying a vendor/VulnCheck CVSS 4.0 base score of 9.3 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H). The headline score treats this as a network, no-interaction, no-privilege critical, but that is misleading for real-world triage: exploitation is NOT a remote attack on a running service - it requires a developer (or build pipeline) to run the generator against an attacker-supplied OpenAPI document and then import/execute the generated client. That is a meaningful user-interaction/trust-boundary step the CVSS 4.0 UI:N does not capture, so I independently add UI:R (see assessed vectors below). On the exploitation signals: there is no CISA KEV listing, no EPSS probability supplied, and no public exploit code identified at time of analysis - so there is no evidence of active or at-scale exploitation; this is a disclosure-stage finding from VulnCheck with concrete source-line references to the vulnerable Handlebars templates. Net: genuinely high technical impact (arbitrary JavaScript execution) within a specific supply-chain/build-time threat model, but real-world risk is bounded by the need to process an untrusted spec. Treat as a priority for teams that generate clients from third-party or user-supplied OpenAPI documents, and as lower urgency for teams generating only from their own trusted specs. Note also the product is a deprecated project, so a maintained upstream fix may not be available - verify remediation path.

An attacker publishes or supplies a crafted OpenAPI document containing a single quote plus JavaScript in a field such as a path key, parameter name, servers[0].url, or info.version. A victim developer or CI pipeline runs openapi-typescript-codegen (<=0.31.0) against that document, and the unescaped value breaks out of a single-quoted string literal in the generated TypeScript. The injected JavaScript then executes when the generated client is imported or a service method is called. No public exploit code was identified at time of analysis, though the VulnCheck advisory and CVE references point directly to the vulnerable template lines.