Block Remote Code Execution in openapi-typescript-codegen Before Version 0.31.0

The openapi-typescript-codegen tool contains a critical security flaw that allows remote attackers to execute arbitrary JavaScript code. This vulnerability affects all versions of the software up to and including 0.31.0, posing a significant risk to development environments and production systems that rely on generated API clients.

The National Vulnerability Database assigns CVE-2026-108551 a CVSS score of 9.3, rating the severity as critical. The flaw stems from improper handling of input values within the code generation process, specifically involving unescaped data interpolated into single-quoted string literals. This weakness is classified under CWE-94, indicating a failure to neutralize elements that can modify code structure.

Context and Background

The vulnerability exists because the generator does not properly escape special characters when creating TypeScript code from OpenAPI specifications. An attacker who can control or influence an OpenAPI document can exploit this lack of sanitization. By supplying crafted inputs, they can break out of the intended string context and inject executable JavaScript statements.

According to the NVD record, the injection occurs when the tool processes specific fields within the API definition. The generator treats these inputs as safe code components, but malicious actors can manipulate them. This results in the creation of client libraries that contain hidden, executable code rather than just standard API interaction logic.

Who Is Affected

Developers and organizations using openapi-typescript-codegen version 0.31.0 or earlier are directly affected by this issue. The tool is commonly used to generate TypeScript client libraries from OpenAPI specifications, streamlining the integration of APIs into applications. Any project relying on these generated clients faces potential compromise if the source API definition is untrusted or manipulated.

Attackers can embed a single quote in several key locations within the OpenAPI document to trigger the exploit. These locations include path keys, parameter names, the servers[0].url field, and the info.version field. When the generated code is imported into an application or when service methods are called, the injected JavaScript executes automatically, potentially leading to remote code execution.

What to watch

Business leaders should monitor their software inventory for any usage of openapi-typescript-codegen. Since the vulnerability allows arbitrary code execution, the impact can range from data theft to full system takeover. Organizations should verify the versions of all code generation tools in their development pipelines and assess the trustworthiness of the OpenAPI specifications they consume.

WHAT TO DO:

• Audit your project dependencies to identify if openapi-typescript-codegen version 0.31.0 or earlier is installed.
• Review all OpenAPI specifications used in your projects to ensure they come from trusted, verified sources.
• Implement strict input validation and sanitization checks for any API definitions before running them through code generators.
• Once the vendor provides an update, upgrade to a patched version that properly escapes single-quoted string literals.

What to do and how to stay safe: openapi-typescript-codegen

• Advisories bridge the gap between raw vulnerability data and business risk, enabling informed patch prioritization.
• Ignoring advisories leads to technical debt accumulation, where minor issues compound into complex, unpatchable system failures.
• Structured advisory workflows reduce mean time to remediate by eliminating guesswork and focusing efforts on high-impact threats.

Security advisories provide the technical context necessary to prioritize patches and mitigate risks effectively. Review advisories daily and map them to your specific assets to focus remediation efforts where they matter most.

Step-by-step guide: How Security Advisories Drive Patch Decisions and Reduce Risk

General security guidance from the Shell Bulletin newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-108551?

CVE-2026-108551 is a critical code injection vulnerability in openapi-typescript-codegen that allows attackers to execute arbitrary JavaScript via malicious OpenAPI documents.

Which versions of openapi-typescript-codegen are affected?

All versions of openapi-typescript-codegen up to and including 0.31.0 are affected by this vulnerability.

How can an attacker exploit this flaw?

Attackers can embed a single quote in path keys, parameter names, servers[0].url, or info.version in an OpenAPI document to inject and execute JavaScript.