Summary
A critical code injection vulnerability in openapi-typescript-codegen allows attacker-controlled OpenAPI documents to introduce JavaScript into generated client source code. When the generated client is imported or a vulnerable service method is called, the injected code may execute in the consuming environment.
A critical code injection vulnerability in openapi-typescript-codegen allows attacker-controlled OpenAPI documents to introduce JavaScript into generated client source code. When the generated client is imported or a vulnerable service method is called, the injected code may execute in the consuming environment.
Affected context
The vulnerability affects workflows that generate TypeScript clients from OpenAPI documents using openapi-typescript-codegen through version 0.31.0. Risk is present when an OpenAPI document or any of its relevant metadata fields can be supplied or modified by an untrusted party and generated values are inserted into JavaScript string literals without sufficient escaping.
The vulnerability affects workflows that generate TypeScript clients from OpenAPI documents using openapi-typescript-codegen through version 0.31.0. Risk is present when an OpenAPI document or any of its relevant metadata fields can be supplied or modified by an untrusted party and generated values are inserted into JavaScript string literals without sufficient escaping.
Exploit preconditions
- Attack surface: OpenAPI client generation and subsequent use of the generated JavaScript or TypeScript code
- Required access: Ability to control or modify an OpenAPI document, including selected path, parameter, server, or metadata values
- Trigger point: Importing the generated client or invoking affected generated service methods
- Why exploitation is possible: Unescaped document values are interpolated into single-quoted JavaScript string literals, allowing input to alter generated source structure
- Attack surface: OpenAPI client generation and subsequent use of the generated JavaScript or TypeScript code
- Required access: Ability to control or modify an OpenAPI document, including selected path, parameter, server, or metadata values
- Trigger point: Importing the generated client or invoking affected generated service methods
- Why exploitation is possible: Unescaped document values are interpolated into single-quoted JavaScript string literals, allowing input to alter generated source structure
Why this happens
The underlying bug is an unsafe code-generation pattern in which values originating from an OpenAPI document are inserted into JavaScript source without context-aware escaping or safe serialization. Values containing JavaScript string delimiters can change the intended literal boundary and introduce executable code. This behavior maps to CWE-94: Improper Control of Generation of Code, because data intended for generated output is allowed to influence executable program structure.
The underlying bug is an unsafe code-generation pattern in which values originating from an OpenAPI document are inserted into JavaScript source without context-aware escaping or safe serialization. Values containing JavaScript string delimiters can change the intended literal boundary and introduce executable code. This behavior maps to CWE-94: Improper Control of Generation of Code, because data intended for generated output is allowed to influence executable program structure.
Potential impact
- Arbitrary JavaScript may execute in environments that import or invoke the generated client
- Sensitive credentials, source code, or environment data could be exposed
- Generated applications or build pipelines could be compromised
- Downstream users may receive tampered client libraries through a software supply chain
- Integrity of API integrations and generated artifacts could be affected
- Arbitrary JavaScript may execute in environments that import or invoke the generated client
- Sensitive credentials, source code, or environment data could be exposed
- Generated applications or build pipelines could be compromised
- Downstream users may receive tampered client libraries through a software supply chain
- Integrity of API integrations and generated artifacts could be affected
General mitigation guidance
Mitigation generally focuses on treating OpenAPI documents as untrusted data and preventing their contents from becoming executable source structure.
Common defensive patterns include:
- Serializing generated string values with context-appropriate, standards-compliant escaping
- Using structured AST or template-generation mechanisms that separate data from code
- Applying strict schemas and validation to OpenAPI documents before generation
- Restricting who and what can publish or modify API specifications
- Reviewing generated artifacts before they enter builds or release pipelines
- Running generation and downstream tooling with least privilege and limited access to secrets
These controls reduce the likelihood that a malicious specification can alter generated program behavior.
Mitigation generally focuses on treating OpenAPI documents as untrusted data and preventing their contents from becoming executable source structure.
Common defensive patterns include:
- Serializing generated string values with context-appropriate, standards-compliant escaping
- Using structured AST or template-generation mechanisms that separate data from code
- Applying strict schemas and validation to OpenAPI documents before generation
- Restricting who and what can publish or modify API specifications
- Reviewing generated artifacts before they enter builds or release pipelines
- Running generation and downstream tooling with least privilege and limited access to secrets
These controls reduce the likelihood that a malicious specification can alter generated program behavior.
How teams detect issues like this
Organizations can identify this class of issue through:
- Static analysis for direct interpolation of specification values into JavaScript string literals
- Code review checks for missing escaping or serialization at code-generation boundaries
- Tests using delimiter-bearing and other adversarial metadata values to inspect generated source
- CI policies that validate OpenAPI provenance and scan generated artifacts for unexpected executable constructs
- Dependency and source review processes for generators that transform untrusted documents into code
Automated security review tools may help flag unsafe interpolation patterns, but generated output should also be inspected.
Organizations can identify this class of issue through:
- Static analysis for direct interpolation of specification values into JavaScript string literals
- Code review checks for missing escaping or serialization at code-generation boundaries
- Tests using delimiter-bearing and other adversarial metadata values to inspect generated source
- CI policies that validate OpenAPI provenance and scan generated artifacts for unexpected executable constructs
- Dependency and source review processes for generators that transform untrusted documents into code
Automated security review tools may help flag unsafe interpolation patterns, but generated output should also be inspected.
