Executive brief
Orval is a code generation tool that creates API client libraries from OpenAPI specifications. The zod validator code generator fails to properly escape property names from API schemas when generating JavaScript object definitions, allowing attackers to inject arbitrary code that executes when the generated module is imported. An attacker who controls an OpenAPI specification can craft a malicious property name that breaks out of the string context and injects executable code, leading to remote code execution on systems that generate and import the malicious client.
Technical details
The vulnerability is a code injection flaw (CWE-94, CWE-95, CWE-116) in Orval's zod client code generator. When Orval processes an OpenAPI schema, it generates TypeScript/JavaScript code containing zod validators. Property names from the schema are inserted directly into object literal keys without escaping—e.g., `zod.object({ "propertyName": ... })`. An attacker-controlled property name containing a double-quote character (") breaks out of the string context and lands in object-literal position, where a computed property key `[require("fs").writeFileSync(...)]` is evaluated immediately when the `zod.object({...})` call executes. Since this is an `export const` statement, evaluation occurs at module import time, not call time. The attack requires only that a developer generate code from an attacker-supplied spec and import it; no user interaction or privileges are required. The fix is to properly escape property names using JSON.stringify when generating the object key literal.
Affected products
- Orval orval < 8.21.0
Timeline
- 2026-07-12: disclosed: Initially published by maintainer
- 2026-09-02: advisory: GitHub Advisory Database (GHSA-6mr6-jvcr-2f25) and NVD published
- 2026-07-12: patched: Fix released in orval v8.21.0