openapi-typescript-codegen Critical Flaw Allows Arbitrary JS Execution via OpenAPI Inputs

The openapi-typescript-codegen library faces a severe security threat identified as CVE-2026-108551. This vulnerability allows attackers to execute arbitrary JavaScript code within applications that use generated API clients. The flaw exists in versions of the tool up to and including 0.31.0. Security researchers have assigned the issue a CVSS score of 9.3, classifying it as Critical. This high severity rating indicates that successful exploitation requires no user interaction beyond importing the generated code.

How does the vulnerability work?

The flaw stems from improper handling of unescaped values in the code generation process. According to the National Vulnerability Database, the tool interpolates these values directly into single-quoted string literals without proper sanitization. An attacker who can control the input OpenAPI document can exploit this weakness. By injecting a single quote into specific parts of the document, the attacker breaks out of the string context. This allows them to insert and execute arbitrary JavaScript commands when the generated client is imported or when service methods are called.

Which parts of the OpenAPI document are dangerous?

Attackers can target several specific fields within an OpenAPI specification to trigger the injection. The National Vulnerability Database notes that path keys are a primary vector for this attack. Parameter names within the API definition can also be manipulated to inject malicious code. Additionally, the servers[0].url field is vulnerable to this type of exploitation. The info.version field is another location where an attacker can embed a single quote to achieve code execution. Any of these fields, if controlled by a malicious actor, can compromise the integrity of the generated TypeScript code.

What is the impact on organizations?

For organizations relying on openapi-typescript-codegen, the risk is significant. The vulnerability enables remote code execution within the context of the application using the generated client. This means an attacker could potentially steal data, modify application behavior, or pivot to other systems. The impact is particularly severe for development teams that automatically generate API clients from external or untrusted OpenAPI specifications. If the source OpenAPI document is compromised or malicious, the resulting codebase becomes inherently unsafe. This creates a supply chain risk that propagates through the development pipeline.

What should business leaders do now?

Business leaders must assess their exposure to this vulnerability immediately. Teams should identify all projects using openapi-typescript-codegen versions up to 0.31.0. Since no patch has been confirmed in the source material, organizations should consider temporary mitigations. These may include restricting access to OpenAPI generation tools or validating inputs more strictly. Leaders should also review their software supply chain policies to ensure that generated code is scanned for anomalies before deployment. Monitoring for unusual JavaScript execution in development environments is also crucial.

Background: National Vulnerability Database

The National Vulnerability Database is the U.S. government’s repository of security flaws in software and hardware. It assigns unique identifiers to each issue, allowing organizations to track, prioritize, and remediate risks using standardized references rather than vague descriptions.

Read the full guide: National Vulnerability Database: Meaning, Structure, and Daily Use

What to do and how to stay safe: openapi-typescript-codegen

• Audit your project dependencies to identify any usage of openapi-typescript-codegen versions up to 0.31.0.
• Validate all OpenAPI documents used for code generation, ensuring they come from trusted and verified sources.
• Implement strict code review processes for any generated TypeScript clients before integrating them into your codebase.
• Monitor application logs for unexpected JavaScript execution or unusual behavior in API client modules.

Step-by-step guide: Patch Management Checklist: Secure Systems Without Breaking Them

General security guidance from the Firewall Scoop newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-108551?

The National Vulnerability Database rates CVE-2026-108551 as CVSS 9.3, which is classified as Critical.

Which versions of openapi-typescript-codegen are affected?

All versions of openapi-typescript-codegen up to and including 0.31.0 are affected by this vulnerability.

Can this vulnerability be exploited remotely?

Yes, attackers can exploit this by supplying malicious OpenAPI documents, leading to arbitrary JavaScript execution.