openapi-typescript-codegen: Code injection via Handlebars templates
Summary
The openapi-typescript-codegen npm library generates TypeScript API clients from OpenAPI documents. Unescaped values in its Handlebars templates allow code injection (CWE-94), so an attacker who controls an OpenAPI document can run arbitrary JavaScript when a generated client is imported or a service method is called. CVSS 4.0 scores it 9.3 (Critical); some mirrors list CVSS 3.1 9.8. The package is unmaintained and no fixed version has been found.
Affected
- ferdikoomen openapi-typescript-codegen: all versions up to and including 0.31.0
Fixed in
Unknown. No fixed version found. 0.31.0 is still the latest release on npm.
Workaround
- No vendor workaround found.
- Generate clients only from OpenAPI documents you author or fully control.
- Do not generate from third-party or public spec URLs in CI pipelines.
- Review existing generated clients for unexpected code in path strings, server URLs and version fields.
Exploitation
- No confirmed exploitation in the wild found; no CISA KEV listing found.
- CISA SSVC: exploitation none, automatable yes, technical impact total.
- A mirror lists a public exploit entry; its content is unverified.
- EPSS 0.00415 (low predicted exploitation probability).
Our recommendation
- Inventory projects that use openapi-typescript-codegen, including CI pipelines.
- Stop generating clients from untrusted or external OpenAPI documents.
- Plan migration to @hey-api/openapi-ts, as recommended by the vendor.
- Review generated code in the codebase for suspicious content.
- Monitor for a fixed release or further advisories.
Public exploits
Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.
- Proof of concept on GitHub (1 repositories)
Zombie-Kaiser/CVE-2026-108551-POC
Research sources
- VulnCheck advisory www.vulncheck.com
- OSV entry CVE-2026-108551 osv.dev
- CVE record mirror (Vulners) vulners.com
- GitHub repository (vendor notice) github.com
- GitHub issue #2809 github.com
- OpenAPI.hbs template at v0.31.0 github.com
- npm package page www.npmjs.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 02:36.
Original description (NVD)
openapi-typescript-codegen through 0.31.0 contains a code injection vulnerability that allows attackers controlling an OpenAPI document to inject JavaScript by supplying unescaped values interpolated into single-quoted string literals. Attackers can embed a single quote in path keys, parameter names, servers[0].url, or info.version to execute arbitrary JavaScript when generated clients are imported or service methods called.
NVD references (5)
- https://github.com/ferdikoomen/openapi-typescript-codegen
- https://github.com/ferdikoomen/openapi-typescript-codegen/blob/v0.31.0/src/templates/core/OpenAPI.hbs#L20-L23
- https://github.com/ferdikoomen/openapi-typescript-codegen/blob/v0.31.0/src/templates/exportService.hbs#L89-L1…
- https://github.com/ferdikoomen/openapi-typescript-codegen/issues/2809
- https://www.vulncheck.com/advisories/openapi-typescript-codegen-through-0.31.0-code-injection-via-handlebars-…
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.