Openapi Typescript Codegen Through 0.31.0 Code Injection Via Handlebars Templates

Back www.vulncheck.com

Openapi Typescript Codegen Through 0.31.0 Code Injection Via Handlebars Templates

www.vulncheck.com • October 10, 2026

Share: View original

openapi-typescript-codegen through 0.31.0 Code Injection via Handlebars Templates

openapi-typescript-codegen <= 0.31.0

openapi-typescript-codegen <= 0.31.0

CWE-94 Improper Control of Generation of Code ('Code Injection')

Ready to get Started?

Vulnerability Prioritization Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.

Early Warning System Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Code Injection Vulnerability in openapi-typescript-codegen Disclosed A critical code injection vulnerability, CVE-2026-108551, was disclosed on October 10, 2026, affecting openapi-typescript-codegen versions up to 0.31.0. The flaw allows attackers to inject JavaScript into generated TypeScript clients via unescaped values in OpenAPI documents, potentially compromising CI/CD pipelines. This vulnerability has a CVSS score of 9.8, indicating a high risk of remote code execution without authentication. Currently, there is no public exploit code available, and it is not listed in the CISA Known Exploited Vulnerabilities catalog. Organizations are advised to apply security patches and monitor systems for signs of exploitation. The vulnerability primarily impacts developers and organizations using the affected code generator in their build environments. 1 sources 71

Extracted Entities

Attack Types (1)

CWE Weaknesses (1)

CWE-94 - Code Injection

Platforms (1)