CVE-2026-108551

Summary

The vulnerability allows attackers to inject arbitrary JavaScript code into generated OpenAPI client code by manipulating unescaped values in single-quoted string literals within OpenAPI documents. This can lead to remote code execution when the generated clients are imported or used.

Exploitability

Exploitation is relatively straightforward as attackers only need to control an OpenAPI document with unescaped single quotes in path keys, parameter names, server URLs, or version fields to inject JavaScript code that executes during client usage.

Blast radius

The impact could be significant across any application using generated clients from vulnerable OpenAPI documents, potentially affecting multiple services and users who import or call those clients.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to openapi-typescript-codegen 0.31.1 or later to fix the code injection vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.