AIKIDO-2026-10236

TL;DR

Affected versions of this package allow untrusted OpenAPI fields (e.g., descriptions, examples, patterns) containing */ to prematurely terminate JSDoc comments in generated TypeScript, resulting in malformed code and potential comment injection. An attacker controlling or influencing the OpenAPI specification could craft malicious values that break code generation, inject unintended content into source files, or disrupt build pipelines and downstream tooling. This may enable denial of service in CI/CD processes or facilitate further code manipulation if generated artifacts are trusted or executed without validation.