Executive brief
Orval is a code generator that creates type-safe API clients from OpenAPI specifications. When configured to generate MSW (Mock Service Worker) mocks, Orval fails to properly escape property names from the API specification, allowing an attacker to inject arbitrary JavaScript code through schema property names. An attacker controlling the OpenAPI specification can inject code that executes with the privileges of the developer's machine when tests or mock handlers are run, potentially leading to data theft, system compromise, or malware installation.
Technical details
Orval generates MSW mock factories from OpenAPI specifications. When emitting schema property names as object keys in the generated mock factory code, the tool wraps property names in single quotes without escaping single-quote characters. A property name containing a single quote (e.g., `x': 0, [require("fs").writeFileSync("PWNED","")]: 0, 'y`) breaks out of the quoted key context and injects a computed property key [expr] that is evaluated at runtime (when the mock factory is invoked in tests or MSW handlers). This is a code injection vulnerability: the attacker-controlled property name from the OpenAPI spec lands in an object-literal context and enables arbitrary JavaScript/Node.js command execution. The root cause is missing string escaping; the fix applies proper escaping (jsStringLiteralEscape) to single-quoted keys in mock generation. The vulnerability requires an attacker to control the OpenAPI specification provided to Orval, and execution occurs when the generated mocks are imported or called by developers. Fixed in version 8.21.0.
Affected products
- Orval Labs Orval all versions before 8.21.0
Timeline
- 2026-09-03: disclosed: GHSA published; advisory GHSA-2w86-xfrc-g85r and CVE-2026-71867 released
- 2026-07-12: patched: Fix merged in PR #3692 and commit 8ef1bfd; released in v8.21.0