openapi-typescript-codegen Code Injection (CVE-2026-108551)

openapi-typescript-codegen reads an OpenAPI document and writes a TypeScript client from it. VulnCheck's advisory says values from that document land inside single-quoted strings in the generated code with no escaping. A single quote in a path key, a parameter name, servers[0].url or info.version ends the string early. What follows runs as JavaScript when the generated client is imported or when a service method is called.

The researcher who reported it on the project's issue tracker (issue 2809, opened 4 September 2026) adds detail. The version and server URL fields run code as soon as the client's core/OpenAPI.ts file is loaded. The path and parameter-name fields run it on each call of the affected method.

The report also lists the request-body media type and the response header name. It says every HTTP client the tool can generate is affected: fetch, axios, xhr, node and angular. That list goes further than the CVE description.

Who Is at Risk

Our reading: the victim is whoever generates or loads the client, not a server reached over the internet. The issue names three places where the code can run. They are a developer's machine, a CI job that regenerates a client from a remote spec, and an app that loads a spec-driven client at run time.

Anyone who runs the tool on an OpenAPI document written or changed by someone else is exposed. Examples are a vendor's API spec, a partner's file, or a spec fetched from a URL during the build.

The flaw is in the tool's own templates, not in a tampered release, so this is not a poisoned release like the TanStack npm compromise (CVE-2026-45321). It still belongs to the development-tools part of the software supply chain, because the danger arrives through a file your build trusts. Our reading: a client generated earlier from a poisoned document keeps whatever was injected, so review committed generated files as well as the tool.

Scores and Status

VulnCheck assigned the CVE and rates it 9.8 on CVSS 3.1 and 9.3 on CVSS 4.0, both Critical. The vector is network, with no privileges or user interaction. NVD shows those scores and had not added its own analysis when we read it on 25 October (status Deferred).

Our reading: the network vector needs careful reading, because the attack only works when a poisoned OpenAPI document reaches the place where the client is generated or loaded. The issue reporter describes it the same way: the code runs where a client is built or run from an attacker-controlled or attacker-influenced spec.

A Project That Says It Is Unmaintained

The project README opens with a notice that it "has been unmaintained for a while now". It asks users to migrate to @hey-api/openapi-ts, which it says began as a fork.

The latest npm release is still 0.31.0, published 20 June 2026, the last version the CVE lists. Issue 2809 has no comments. npm counted 303,029 downloads of the package from 16 to 22 October 2026.

The CVE record names only openapi-typescript-codegen. The reporter says the same class of bug was reported and fixed earlier in other OpenAPI-to-TypeScript generators and names Orval and swagger-typescript-api. If you move to another tool, ask how it escapes values taken from the spec.

What GitHub, X and Telegram Show

GitHub: one public repository carries the CVE id. It was created on 23 October 2026 and describes itself as a "Defense guide + static scanner". Its README says it also holds a non-weaponized, educational demonstration that writes a harmless marker file.

The issue reporter says a proof of concept is available on request. We read the README as data, did not run anything and do not link the repository.

X: four public posts about the flaw appeared between 23 and 25 October. The widest came from a threat-news account with about 250,000 followers. On 24 October it posted on X that the repository holds a proof of concept and gave its link. The account's claim is its own, not ours.

FIRST's EPSS model gave a probability of 0.4% (35th percentile) on 24 October.

The NVD record, supplied by VulnCheck, lists the npm package openapi-typescript-codegen from version 0 up to and including 0.31.0. The latest release on npm is 0.31.0, so every published release is in range.

No fixed version exists. The issue reporter confirmed the flaw on the main branch at commit d7c2a99 on 4 September 2026.

Is It Exploited Yet?

The CISA coordinator SSVC entry in the NVD record is dated 13 October 2026. It lists exploitation as none, automatable as yes and technical impact as total. The flaw was not in the CISA Known Exploited Vulnerabilities catalog in its 23 October 2026 release.