openapi‑typescript‑codegen up to version 0.31.0 contains a code injection flaw that allows a malicious actor to embed arbitrary JavaScript code in the OpenAPI specification. By inserting unescaped single quotes in path keys, parameter names, the first servers URL, or the info.version field, the templating engine will interpolate these values into single‑quoted string literals, causing the generated client to execute the injected script when the client is imported or service methods are invoked. This flaw can lead to remote code execution in any runtime that consumes the generated client, undermining confidentiality, integrity and availability for affected applications.

The affected product is the openapi‑typescript‑codegen package maintained by ferdikoomen on GitHub. Versions through 0.31.0, including the 0.31.0 release, are vulnerable. Users who depend on any of these releases or older pinned versions are at risk unless they obtain a later patch or mitigate the input.

The CVSS score of 9.3 marks this vulnerability as critical. Although the EPSS score is not available, the lack of a known exploit does not diminish the potential for abuse, especially in environments that automatically generate clients from untrusted OpenAPI documents. The attack requires an attacker to supply a malicious OpenAPI file to the code generation process; if the target application imports the resulting client or invokes its service functions, the injected JavaScript will execute with the privileges of the consuming process. The vulnerability is not listed in the CISA KEV catalog, but its high severity warrants immediate attention.