CVE-2026-108551Published
openapi-typescript-codegen through 0.31.0 Code Injection via Handlebars Templates
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-108551 · Microsoft / collected KEV context
cve-program · CVE-2026-108551
- https://github.com/ferdikoomen/openapi-typescript-codegen/issues/2809
- https://github.com/ferdikoomen/openapi-typescript-codegen
- https://github.com/ferdikoomen/openapi-typescript-codegen/blob/v0.31.0/src/templates/exportService.hbs#L89-L110
- https://github.com/ferdikoomen/openapi-typescript-codegen/blob/v0.31.0/src/templates/core/OpenAPI.hbs#L20-L23
- https://www.vulncheck.com/advisories/openapi-typescript-codegen-through-0.31.0-code-injection-via-handlebars-templates
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.