AIKIDO-2026-923161

encore.dev is vulnerable to Code Injection

Code InjectionGHSA-jm2f-2pwf-qfv9 Published 2 days ago

Low Risk

This Affects:

encore.dev

0.0.1 - 1.57.12

Fixed in 1.57.13

Are you affected? Scan for Free

TL;DR

The Encore JavaScript and TypeScript client generators copy values from an application's API definitions into the generated client without adequate escaping. Doc comments are written verbatim into block-comment markers, so a comment containing the closing sequence ends the block early and turns following text into executable code, and several string literals, including response header wire names from header struct tags, are interpolated without escaping. Running encore gen client against an application with such definitions produces a client file that executes chosen code when imported, including in editors, test runs, and CI. The fix routes generated strings through an escaper and rewrites the closing sequence inside doc comments so injected content can no longer break out.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and you run encore gen client against an application whose API definitions, such as doc comments or header struct tags, can contain untrusted content.