CVSS 9.8 Code Injection in openapi-typescript-codegen

The vulnerability is in how openapi-typescript-codegen handles string values from the spec it processes. Values that land in generated code template fields are not escaped before interpolation, so an attacker with control over any of those string values in an OpenAPI document can inject JavaScript that ends up in the generated client code verbatim.

CVE-2026-108551 carries a CVSS score of 9.8 critical. All versions of openapi-typescript-codegen through 0.31.0 are affected.

The specific attack path

Generated TypeScript clients from an OpenAPI spec typically get committed into codebases, bundled into front-end builds, or published as internal packages. The injection point is the spec file itself.

If the spec a team consumes comes from a third-party API provider, from a URL fetched at build time, or from a shared registry without integrity verification, an attacker who can modify that spec can control what ends up in the generated code.

Generated code is rarely reviewed with the same scrutiny as handwritten code. Pull requests that show only auto-generated output changes tend to get merged without line-by-line inspection. A JavaScript payload embedded in a schema description or endpoint name field can persist through code review, CI, and into production.

What “attacker controlling an OpenAPI document” means in practice

It does not require access to the developer’s machine. It requires write access to a spec source: a public API spec served over HTTP without integrity checks, a shared Swagger Hub entry with permissive permissions, a spec file in a repository with broader write access than the consumer, or a mirror of an upstream spec with stale hash verification.

Most internal tooling that auto-generates clients on a CI schedule pulls specs from an upstream URL. If that URL is not verified against a known-good hash and the transport is not authenticated, the spec is an external input the pipeline trusts without inspection.

The TanStack supply chain incident last month required direct source code compromise. This attack path is one step further upstream: compromise the input spec, let the existing build tooling generate the poisoned output on your behalf, unmodified.

The broader pattern is consistent with what the Git hash chain malleability research laid out: trust propagates along the toolchain, and the weakest link in that chain is usually an unauthenticated fetch.

What to do

Check the openapi-typescript-codegen repository for a patched release past 0.31.0. If no updated release is available, the project may be superseded by an actively maintained fork, in which case migration is the correct path rather than waiting.

For any pipeline running this tool against external specs now: add hash verification on the spec file before the generation step runs. A spec that changes unexpectedly between builds should fail the pipeline, not proceed silently.

If using this library in a CI context where the spec source is partially trusted, review the last several generated outputs before the next merge. Unexpected JavaScript in generated client files is the indicator.