CVE-2026-108551

#NØØT_Security_Alerts 🚨 #ALERT — CRITICAL OPENAPI CODE GENERATOR FLAW ENABLES ARBITRARY JAVASCRIPT EXECUTION October 10, 2026 PRODUCT: openapi-typescript-codegen (npm) CVE: CVE-2026-108551 SEVERITY: Critical — CVSS 9.3 (v4) AFFECTED VERSIONS: 0.31.0 and earlier. No verified fixed release. IMPACT: Attackers controlling an OpenAPI specification can inject malicious JavaScript into generated TypeScript clients. Code may execute when the client is imported or an affected API method runs, potentially compromising CI pipelines and applications. EXPLOITATION STATUS: CONFIRMED CODE-INJECTION VULNERABILITY. Initially reported September 4; CVE published October 10. No verified active exploitation or publicly released PoC. Forensic triage: Inspect OpenAPI path keys, parameter names, servers[0].url, and info.version for suspicious JavaScript. Review generated clients and CI execution logs. URGENT ACTION: Stop processing untrusted OpenAPI specifications. Audit existing generated clients, restrict CI inputs, and monitor for a verified security fix. SOURCE: https://github.com/ferdikoomen/openapi-typescript-codegen/issues/2809 CVE RECORD: https://github.com/advisories/GHSA-3pr5-x7xf-mg4g CONFIDENCE: HIGH — Published CVE and identifiable vulnerable template code. Real-world exploitation remains unverified. #CyberSecurity #ThreatIntel #CodeInjection #DevSecOps #SupplyChainSecurity #NØØT

🚨Critical - openapi-typescript-codegen JS Code Injection via OpenAPI Spec Interpolation (CVE-2026-108551) openapi-typescript-codegen <= 0.31.0 interpolates unescaped OpenAPI fields into single-quoted JS string literals. A malicious spec can inject a ' via path keys, parameter names, servers[0].url, or info.version, leading to arbitrary JS execution when generated clients are imported or when service methods run. 👉Affected: openapi-typescript-codegen <= 0.31.0

Your CI/CD pipeline trusts OpenAPI specs. Should it? CVE-2026-108551: openapi-typescript-codegen ≤0.31.0 injects JavaScript from an attacker-controlled spec into every generated client. Both CVSS 9.8. Neither has active exploits yet. 🔗 https://threataft.com/articles/code-injection-duo-cve-2026-108551-108598 #CyberSecurity

⚠️ CVE-2026-108551 : openapi-typescript-codegen ≤0.31.0 permet d'injecter du JavaScript via une spécification OpenAPI piégée. Risque pour les pipelines CI/CD. Aucune exploitation confirmée. Projet non maintenu : migrez vers @hey-api/openapi-ts. #Cyber #DevSecOps

openapi-typescript-codegen said two years ago it would deprecate all its npm versions. None of the 109 ever was, and the latest carries a 9.8 code injection with no fix. No exploitation reported. https://severitydaily.com/openapi-typescript-codegen-cve-2026-108551-no-fix-0-31-0-npm-deprecation-never-applied/