CVE-2026-108551: Ferdikoomen Openapi-TypeScript-Codegen

Critical severity, CVSS 9.8.

openapi-typescript-codegen through 0.31.0 contains a code injection vulnerability that allows attackers controlling an OpenAPI document to inject JavaScript by supplying unescaped values interpolated into single-quoted string literals. Attackers can embed a single quote in path keys, parameter names, servers[0].url, or info.version to execute arbitrary JavaScript when generated clients are imported or service methods called.

Affected products

• Ferdikoomen Openapi-TypeScript-Codegen: up to and including 0.31.0

Published 2026-10-10. Last modified 2026-10-10.