Code Injection Vulnerability in OpenAPI TypeScript Codegen by Ferdikoomen
CVE-2026-108551

9.3CRITICAL

Key Information:

Vendor

Ferdikoomen

Status
Openapi-typescript-codegen
Vendor
CVE Published:
10 October 2026

What is CVE-2026-108551?

The OpenAPI TypeScript Codegen tool, specifically version 0.31.0, is susceptible to a code injection vulnerability. Attackers can manipulate the OpenAPI document to inject malicious JavaScript. This occurs when supplied unescaped values are interpolated into single-quoted string literals, impacting path keys, parameter names, servers[0].url, or info.version. Consequently, when the generated clients are imported, or when service methods are invoked, it allows for the execution of arbitrary JavaScript, posing significant security risks. Users are advised to update their versions to address this issue.

Affected Version(s)

openapi-typescript-codegen 0 <= 0.31.0

References

https://github.com/ferdikoomen/openapi-typescript-codegen...
issue-tracking
https://github.com/ferdikoomen/openapi-typescript-codegen
product
https://github.com/ferdikoomen/openapi-typescript-codegen...
technical-description

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

George Chen
.