Executive brief
Orval is a widely-used Node.js code generator that creates TypeScript/JavaScript API clients from OpenAPI specifications. When processing header parameter names, Orval's zod client generation embeds these names directly into JavaScript object keys without escaping special characters. An attacker can craft a malicious OpenAPI specification with specially-crafted header names (containing quotes and JavaScript code) that break out of the string context and execute arbitrary code when the generated client module is imported. This occurs at module load time, before any user code runs, giving attackers complete control over the developer's machine or build environment.
Technical details
The vulnerability is a code-injection flaw in orval's zod client generator. When emitting zod.object({...}) schemas, header parameter names are inserted as double-quoted string keys without escaping: `{ "headerName": zod.string() }`. If a header name contains a double-quote (e.g., `a",["code"]:x"` ), it closes the string and creates a computed property key context `[expr]` where arbitrary JavaScript expressions are evaluated at object construction time. Since the schema is exported as `export const OpHeader = zod.object({...})`, this code executes synchronously during module import/load, before any application code runs. The attack vector is network-based (via a malicious OpenAPI spec) with no authentication or user interaction required. An attacker can achieve arbitrary OS command execution via Node's `require("child_process")` or similar. Orval 8.21.0 fixes this by properly escaping parameter names using JSON.stringify when generating object keys. The hono client is also affected as it reuses the same zod generation code.
Affected products
- Orval Labs orval < 8.21.0
- Orval Labs orval hono client < 8.21.0
Timeline
- 2026-09-03: disclosed
- 2026-09-03: patched: Version 8.21.0 released with fix