Skip to content
brandefense.io
Request A Demo
Trending Vulnerabilities

Why it is trending

CVE-2026-108551

openapi-typescript-codegen through 0.31.0 Code Injection via Handlebars Templates

Low
  • CVSS 9.3
  • Public PoC
Buzz
18discussion, 0-100
Danger
40exploitability, 0-100
Mentions
7since 10 Oct 2026
EPSS
0.4%exploit probability
Mentions Per Day · UTCpeak 3
29 days agoToday
Where The Talk Is · by platform7 total
  • X5 mentions · 2 voices
  • GitHub2 mentions · 2 voices · 2 PoC
Newest Public Posts · plain text, newest first

X

  • CVE-2026-108551 Lets Attackers Slip JavaScript Into Generated API Clients, Exploit Code Is Live on GitHub https://t.co/sHfqkhfz6u #cybersecurity #threatintelligence https://t.co/S9BzWO8Mkk

    @cybr_monk3 h agolikes 0views 5replies 0Open

  • 🚨Critical - openapi-typescript-codegen JS Code Injection via OpenAPI Spec Interpolation (CVE-2026-108551) openapi-typescript-codegen = 0.31.0 interpolates unescaped OpenAPI fields into single-quoted JS string literals. A malicious spec can inject a ' via path keys, parameter names, servers[0].url,…

    @UpwindMDR13 d agolikes 0views 80replies 0Open

  • Your CI/CD pipeline trusts OpenAPI specs. Should it? CVE-2026-108551: openapi-typescript-codegen ≤0.31.0 injects JavaScript from an attacker-controlled spec into every generated client. Both CVSS 9.8. Neither has active exploits yet. 🔗 https://t.co/xkhvmtkfiu #CyberSecurity

    @ThreatAft13 d agolikes 0views 66replies 0Open

  • ⚠️ CVE-2026-108551 : openapi-typescript-codegen ≤0.31.0 permet d'injecter du JavaScript via une spécification OpenAPI piégée. Risque pour les pipelines CI/CD. Aucune exploitation confirmée. Projet non maintenu : migrez vers @hey-api/openapi-ts. #Cyber #DevSecOps

    @TwitGri13 d agolikes 0views 77replies 0Open

  • #NØØT_Security_Alerts 🚨 #ALERT — CRITICAL OPENAPI CODE GENERATOR FLAW ENABLES ARBITRARY JAVASCRIPT EXECUTION October 10, 2026 PRODUCT: openapi-typescript-codegen (npm) CVE: CVE-2026-108551 SEVERITY: Critical — CVSS 9.3 (v4) AFFECTED VERSIONS: 0.31.0 and earlier. No verified fixed release. IMPACT: A…

    @Python_s_13 d agolikes 1views 77replies 0Open

GitHub

  • Zombie-Kaiser/CVE-2026-108551: Defense guide + static scanner for CVE-2026-108551 (openapi-typescript-codegen code injection).

    Zombie-Kaiser/CVE-2026-10855110 h agostars 0PoCOpen

  • GitHub cross-source: Zombie-Kaiser/CVE-2026-108551-POC: Defense guide + static scanner for CVE-2026-108551 (openapi-typescript-codegen code injection).

    Zombie-Kaiser/CVE-2026-108551-POC10 h agostars 0PoCOpen
Public PoC Repositories · third-party code2 links

Links are collected from public posts and are not reviewed by Brandefense. Exploit code can be unsafe or malicious: only study it in an isolated lab, and never run it against systems you do not own.

Get a morning brief and an alert the moment a critical vulnerability like this one starts trending.

Subscribe