An attacker who can provide or influence an OpenAPI document processed by this library can inject a single quote character to break out of the intended string literal. This allows for the injection and execution of arbitrary JavaScript code during the client generation phase or when service methods are subsequently invoked in a client application. This vulnerability presents a high risk for CI/CD pipelines and automated workflows that ingest external or untrusted OpenAPI definitions to generate API client code.

Impact

Successful exploitation leads to arbitrary code execution within the context of the environment running the code generation tool or the consumer of the generated client. This could facilitate command execution, data exfiltration, or secondary supply chain attacks if the generated client is integrated into downstream software.

Recommendation

• Immediately update the openapi-typescript-codegen dependency to a version beyond 0.31.0 that includes sanitization fixes for input interpolation.
• Audit all build and development pipelines that use this library to ingest OpenAPI definitions from external, third-party, or user-provided sources.
• Implement strict input validation for any OpenAPI documents that are automatically processed by internal CI/CD tooling.