psf-openapi-codegen-check(8)
openapi-typescript-codegen code injection, October 2026: read-only checker (v1)
CVE-2026-108551
If this software is helpful, consider a donation to our 501c3 nonprofit:
https://privacysafe.foundation
openapi-typescript-codegen (npm, through 0.31.0) copies strings from an
OpenAPI document into single-quoted JavaScript literals in the TypeScript it
generates, without escaping them: path keys, parameter names, media types,
response header names, servers[0].url and info.version. A single quote in
one of those values ends the literal and the rest runs as code. A value in
servers[0].url or info.version runs when the generated client is imported;
a path or parameter name runs when the affected method is called.
The victim is the developer or build job that generates or runs a client
from a document someone else can influence. It is not a bug in a server.
The remedy (0.31.0 is the latest release and is affected) is
to stop using the package, or to stop feeding it documents you do not
control. This script finds where it is used and checks generated code. It
changes nothing and never imports, compiles or runs a generated file.
Usage:
./openapi-codegen-check.sh [command] [arguments]
check (default) find the package in package.json and lockfiles, in
installed node_modules copies, and the CI jobs, scripts
and Makefiles that run it, flagging inputs fetched from a
URL. Root optional. Exit 0 = not found, 1 = found,
2 = something couldn't be read.
scan DIR... static check of generated TypeScript or JavaScript under
each DIR: a spec-derived value that is not exactly one
well-formed single-quoted literal is reported.
Exit 0 = nothing found, 1 = findings, 2 = bad argument.
version print the script version.
Env overrides:
ROOTS="/home /root /srv /var/www /opt /usr/local"
where check looks (default shown). A directory that
does not exist is skipped.
MAX_DEPTH=9 how deep check descends under each root
Containers: with no argument and ROOTS unset, the check also looks in running docker and podman
containers (SCAN_CONTAINERS=1, the default; 0 skips them). A read-only probe copies the
package.json and lockfiles that mention the generator, whole, and the installed
node_modules copy's package.json, into a private temporary directory, and this script runs once
per container in isolation against that copy. Workflows, Makefiles and shell scripts are not read
inside containers. Paths shown as .../docker_NAME/... are inside the container NAME.The Security Patches software and this documentation are dedicated to the public domain under CC0 1.0 Universal. Other pages on privacysafe.app/docs are CC BY-SA 4.0 unless the page says otherwise.
