Code Injection in openapi-typescript-codegen via OpenAPI Document Processing

The openapi-typescript-codegen library (versions up to and including 0.31.0) contains a code injection vulnerability arising from insufficient sanitization of input values within an OpenAPI specification document. When generating TypeScript clients, the tool interpolates fields such as path keys, parameter names, the servers[0].url field, or the info.version string into single-quoted JavaScript string literals without proper escaping.

An attacker who can provide or influence an OpenAPI document processed by this library can inject a single quote character to break out of the intended string literal. This allows for the injection and execution of arbitrary JavaScript code during the client generation phase or when service methods are subsequently invoked in a client application. This vulnerability presents a high risk for CI/CD pipelines and automated workflows that ingest external or untrusted OpenAPI definitions to generate API client code.

Impact

Successful exploitation leads to arbitrary code execution within the context of the environment running the code generation tool or the consumer of the generated client. This could facilitate command execution, data exfiltration, or secondary supply chain attacks if the generated client is integrated into downstream software.

Recommendation

• Immediately update the openapi-typescript-codegen dependency to a version beyond 0.31.0 that includes sanitization fixes for input interpolation.
• Audit all build and development pipelines that use this library to ingest OpenAPI definitions from external, third-party, or user-provided sources.
• Implement strict input validation for any OpenAPI documents that are automatically processed by internal CI/CD tooling.