Cyber & AI intelligence
Wasteland.
Briefs indexed3476
Issues33
Published Mondays07:30 CT
⚡ Active KEV CVE-2026-108551 2026-10-10

CVE-2026-108551: Critical Code Injection in openapi-typescript-codegen Through 0.31.0

"A critical code injection flaw in openapi-typescript-codegen through version 0.31.0 lets an attacker who controls an OpenAPI document run arbitrary JavaScript when the generated clients are used."

A critical code injection flaw in openapi-typescript-codegen through version 0.31.0 lets an attacker who controls an OpenAPI document run arbitrary JavaScript when the generated clients are used.

What Is It

CVE-2026-108551 is a code injection vulnerability (CWE-94) in openapi-typescript-codegen, an npm package maintained by ferdikoomen. The generator copies values from an OpenAPI document into single-quoted string literals in the generated code without escaping them. An attacker can put a single quote in certain fields to break out of the string and inject JavaScript. The affected fields are:

The injected code runs when the generated client is imported or when a service method is called. The advisory traces the issue to the package's Handlebars templates, including core/OpenAPI.hbs and exportService.hbs.

Why It Matters

VulnCheck, the CNA, scores the flaw as CRITICAL:

Both vectors show network attack, low complexity, no privileges, no user interaction, and high impact to confidentiality, integrity, and availability.

The risk is in the build pipeline. Teams that generate TypeScript clients from OpenAPI specs they don't fully control, such as third-party, partner, or user-supplied specs, can end up with attacker-controlled code in their own applications.

The CISA Known Exploited Vulnerabilities (KEV) Catalog has no entry for this CVE as of publication, so KEV does not confirm active exploitation.

What's Vulnerable

The vulnerability lives in the generated code, so client code already produced by affected versions from untrusted specs may also carry injected content.

Patch Status

The NVD record (status: Received, published 2026-10-10) does not list a fixed version or vendor remediation. No KEV-required action applies because the CVE is not listed in the CISA KEV Catalog. Until a fix is confirmed, teams should:

Sources