CVE-2026-108551: Improper Control of Generation of Code ('Code Injection') in ferdikoomen openapi-typescript-codegen

CVE-2026-108551 is a critical code injection vulnerability in the openapi-typescript-codegen project (versions up to and including 0.31.0). The vulnerability arises because the tool interpolates unescaped user-controlled values into single-quoted JavaScript string literals when generating client code from OpenAPI documents. Attackers controlling the OpenAPI specification can embed single quotes in specific fields such as path keys, parameter names, servers[0].url, or info.version, enabling arbitrary JavaScript execution upon client import or method invocation.

Successful exploitation allows remote attackers with control over an OpenAPI document to execute arbitrary JavaScript code in the context of the generated client. This can lead to full compromise of the client environment, including unauthorized actions and data access. The CVSS 4.0 score is 9.3 (critical), reflecting the high impact and ease of exploitation without authentication or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using untrusted OpenAPI documents with openapi-typescript-codegen or sanitize inputs to prevent injection. Monitor the vendor's channels for updates and apply patches promptly once released.