Code Injection via Unescaped OpenAPI Spec Strings in Generated Clients (RCE)

Vulnerability Overview Title: Code injection via unescaped spec-derived strings in generated clients (RCE from an untrusted OpenAPI spec) #2809 Description: Several templates directly insert strings from the OpenAPI specification into single-quoted JavaScript string literals in the generated output without escaping. A single quote within a specification value prematurely closes the string literal, causing the remaining portion to be executed as live JavaScript code. Affected fields include: request paths, wire names for each path/query/header/cookie parameter, request body media types, response header names, the first server URL, and the API version. Affected Versions: Confirmed on the branch, commit #7c2a99 (2026-09-04, latest at time of reporting), affecting all HTTP clients (fetch/axios/xhr/node/angular). Impact Code Execution: In any environment where a client is generated from or executed against an attacker-controlled or compromised OpenAPI description. Examples include: developers running the generator locally, CI pipelines regenerating clients from remote specifications, or applications fetching and dynamically executing spec-driven clients. Two Distinct Severity Levels: - Per-Method RCE: Code injected via request paths or parameter names executes every time an affected generated method is called. - Import-time RCE: Code injected via server URLs or API versions executes immediately when (or any generated service file) is loaded, before any methods are invoked. Remediation The author has prepared a fix and will submit a Pull Request shortly. POC Code Summary This vulnerability involves unescaped OpenAPI specification strings in generated client code, leading to code injection and execution. The affected versions include all HTTP clients, and a fix is about to be submitted.

Goal Reached Thanks to every supporter — we hit 100%!

Code Injection via Unescaped OpenAPI Spec Strings in Generated Clients (RCE)

More from this source