Executive brief
Orval is a code generator that creates TypeScript client libraries and mock data from OpenAPI specifications. This vulnerability allows an attacker to inject arbitrary executable code into generated mock files by embedding malicious payloads in OpenAPI schema definitions. An organization using Orval to generate mocks from untrusted OpenAPI specs could end up with code containing attacker-controlled commands, leading to potential data theft, system compromise, or supply chain attacks.
Technical details
This is a code injection vulnerability in the @orval/mock package's mock generation pipeline, specifically in the getMockScalar function (packages/mock/src/faker/getters/scalar.ts). The vulnerable component fails to properly escape or serialize const values from OpenAPI schema properties when interpolating them into generated TypeScript/JavaScript. An attacker can craft a malicious OpenAPI 3.1.0 specification with const keywords containing arbitrary code (e.g., require('child_process').execSync('id')) that gets emitted unescaped into both interface definitions and faker/MSW mock handlers. The attack requires that Orval be run with mock generation enabled on an untrusted or compromised OpenAPI specification. Patches are available in @orval/mock versions 7.20.0 and 8.0.3.
Affected products
- Orval @orval/mock before 7.20.0 and 8.0.0-rc.0 before 8.0.3
Timeline
- 2026-01-22: disclosed: GHSA advisory published
- 2026-01: patched: Patches released in v7.20.0 and v8.0.3