Executive brief
Orval is a code generation tool that creates API client code from OpenAPI specifications. An incomplete fix for a prior vulnerability leaves the tool susceptible to code injection attacks through malicious enum descriptions in API specs. An attacker who controls the OpenAPI definition can inject arbitrary JavaScript code into the generated files, potentially leading to execution of malicious commands on developers' machines during code generation.
Technical details
This vulnerability is a code injection flaw in the jsStringEscape sanitization function used when processing x-enum-descriptions from OpenAPI specifications. The function properly escapes single and double quotes but fails to sanitize asterisk (*) and forward slash (/) characters. This allows attackers to break out of JavaScript comment blocks using */ sequences and inject arbitrary code. An attacker-controlled OpenAPI spec with malicious x-enumDescriptions can inject code (including operating system commands via child_process imports) that executes during code generation. The vulnerability requires the attacker to control or influence the OpenAPI specification being processed, but no additional authentication or user interaction beyond code generation is needed. Patches are available in version 7.21.0 and later.
Affected products
- Orval Labs Orval >=7.19.0, <7.21.0
Timeline
- 2026-01-30: disclosed
- 2026-01-30: patched: Version 7.21.0 and later