Executive brief
Orval is a code generator that creates type-safe API clients and validators from OpenAPI specifications. The tool is vulnerable to remote code execution when processing malicious OpenAPI files—an attacker can embed executable JavaScript in default values that runs automatically when the generated code is imported, without any request or user interaction needed.
Technical details
The vulnerability exists in Orval's zod code generator, which renders schema default values into JavaScript template literals (export const xDefault = `${value}`) without proper escaping of template literal metacharacters. An attacker-controlled OpenAPI specification can supply a default value containing ${ and } to break out of the template literal and inject arbitrary JavaScript expressions. These expressions execute at module import time in any application that imports the generated zod schema, before any request handling or function calls occur. The root cause is direct interpolation of spec-controlled values into template literals without sanitization. The vulnerability affects all versions prior to 8.21.0, where a fix was applied using jsesc to properly escape backticks and ${ sequences in default values at code generation boundaries.
Affected products
- Orval Labs Orval before 8.21.0
Timeline
- 2026-09-03: disclosed
- 2026-07-12: patched: Fix released in version 8.21.0