openapi-typescript-codegen through 0.31.0 contains a code injection vulnerability that allows attackers controlling an OpenAPI document to inject…
openapi-typescript-codegen through 0.31.0 contains a code injection vulnerability that allows attackers controlling an OpenAPI document to inject JavaScript by supplying unescaped values interpolated into single-quoted string literals. Attackers can embed a single quote in path keys, parameter names, servers[0].url, or info.version to execute arbitrary JavaScript when generated clients are imported or service methods called.
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- Oracle
- Product
- java
- CVSS
- 9.8
Why it ranks 18 (Routine)
- CVSS 9.8 critical
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.