Threats tagged 'ghsa-3pr5-x7xf-mg4g'

openapi-typescript-codegen versions up to and including 0.31.0 contain a critical code injection vulnerability. This flaw allows attackers who can control an OpenAPI document to inject arbitrary JavaScript code by supplying unescaped values that are interpolated into single-quoted string literals. The injection points include path keys, parameter names, servers[0].url, and info.version fields. Exploitation occurs when generated clients are imported or service methods are called, leading to arbitrary code execution.