Key points
- The flaw is rated CVSS 9.3 Critical by the National Vulnerability Database.
- Attackers can embed single quotes in specific OpenAPI fields to execute code.
- Versions of openapi-typescript-codegen up to 0.31.0 are affected.
A severe security flaw in the popular developer tool openapi-typescript-codegen allows attackers to run arbitrary JavaScript code on vulnerable systems. The National Vulnerability Database has assigned the issue CVE-2026-108551 and rated it with a CVSS score of 9.3, classifying it as critical. This vulnerability affects all versions of the tool up to and including 0.31.0, exposing developers who use untrusted OpenAPI specifications to significant risk.
In plain English
The vulnerability works by tricking the code generator into including malicious data directly into the JavaScript files it creates. According to the NVD record, the tool fails to properly escape values that are inserted into single-quoted string literals. An attacker who can control or modify an OpenAPI document can insert a single quote character into specific fields. When the generated client code is imported or when service methods are called, this injected JavaScript executes automatically, potentially allowing the attacker to take control of the application or steal data.
The background
The issue stems from how openapi-typescript-codegen handles input from OpenAPI specification files. The NVD description notes that attackers can embed single quotes in several key areas, including path keys, parameter names, the server URL field, or the info version field. These fields are typically expected to contain safe, alphanumeric data. By inserting a single quote, the attacker breaks out of the intended string context, allowing them to append arbitrary JavaScript commands. This type of flaw is categorised as CWE-94, or code injection, and is particularly dangerous because it occurs during the build or generation phase rather than at runtime.
What changes now
Developers using openapi-typescript-codegen versions 0.31.0 or earlier must immediately review their workflows. The NVD record confirms that the vulnerability exists in all versions through 0.31.0. No patch or updated version has been confirmed as available in the provided source material. Teams should assume that any OpenAPI document used with this tool could be malicious if it originates from an untrusted source. Until a secure update is released, organisations may need to pause the use of this specific code generator for external or unverified API specifications to prevent accidental execution of harmful scripts.
What to do and how to stay safe: openapi-typescript-codegen
- Audit your project dependencies to identify if you are using openapi-typescript-codegen version 0.31.0 or any earlier release.
- Restrict the use of this code generator to only trusted, internal OpenAPI specifications that you fully control and verify.
- Monitor your build logs and generated code for unexpected JavaScript injections or syntax errors that may indicate exploitation attempts.
- Once the vendor provides an update, test the new version in a isolated environment before deploying it to production systems.
Step-by-step guide: Emergency Patching: Correcting Five Common Operational Errors
General security guidance from the RedTeam Log newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of openapi-typescript-codegen are vulnerable to this injection flaw?
All versions of openapi-typescript-codegen up to and including version 0.31.0 are affected by CVE-2026-108551.
How severe is this vulnerability according to industry standards?
The National Vulnerability Database rates the vulnerability as Critical with a CVSS score of 9.3.
Can an attacker execute code just by providing a malicious OpenAPI document?
Yes, if the document is processed by the vulnerable tool, an attacker can inject JavaScript that executes when the generated client is imported.
