Openapi Typescript Codegen
Monthly
Code injection in openapi-typescript-codegen through 0.31.0 allows attackers who control or influence an OpenAPI document to inject arbitrary JavaScript into generated TypeScript clients, which then executes when the client is imported or its service methods are called. Exploitation requires the victim to generate a client from an attacker-controlled spec (user interaction), and no public exploit code has been identified at time of analysis. The vendor/VulnCheck CVSS 4.0 base score is 9.3, though the independent assessment notes a CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H reflecting the required user interaction; it is not listed in CISA KEV.
Code injection in openapi-typescript-codegen through 0.31.0 allows attackers who control or influence an OpenAPI document to inject arbitrary JavaScript into generated TypeScript clients, which then executes when the client is imported or its service methods are called. Exploitation requires the victim to generate a client from an attacker-controlled spec (user interaction), and no public exploit code has been identified at time of analysis. The vendor/VulnCheck CVSS 4.0 base score is 9.3, though the independent assessment notes a CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H reflecting the required user interaction; it is not listed in CISA KEV.