CVE-2026-108551: code injection in openapi-typescript-codegen

NVD published CVE-2026-108551, a critical (CVSS 9.8) code injection flaw in the npm package openapi-typescript-codegen, which generates TypeScript API clients from OpenAPI documents and is downloaded about 600,000 times a week. Unescaped Handlebars interpolation lets an attacker inject JavaScript via a spec, and no patched version exists — all releases from 0 through 0.31.0 are affected.

• CVSS 3.1 score 9.8 Critical, CWE-94 code injection
• All 109 published versions affected, no patch available
• Injection via servers[0].url, info.version and parameter names
• Package downloaded roughly 600,000 times per week