Executive brief
Orval is a code generation tool that creates TypeScript validation schemas from API specifications. The tool fails to properly escape user-controlled default values when generating zod schema modules, allowing attackers to inject arbitrary JavaScript code that executes automatically when the generated module is imported—without requiring any API request or function call. This affects applications that use Orval to generate schemas from untrusted or attacker-influenced API specifications.
Technical details
Orval is a code generation library that converts OpenAPI specifications into zod validation schemas. The vulnerability is a code injection flaw (CWE-94, CWE-116) in the zod schema generation logic. When emitting default values for header parameters, Orval constructs a module-level template literal string (`export const Default = \`<value>\`;`) without escaping the input. An attacker can craft an OpenAPI specification with a header parameter default value containing template literal syntax—e.g., `v${globalThis.system_call()}w`—which Orval interpolates directly into the template literal. When the generated zod schema module is imported by any application, the `${...}` expression is evaluated as live JavaScript code, achieving remote code execution. The attack requires no authentication, user interaction, or outbound network call; execution occurs automatically at module import time. The fix requires properly encoding default values (e.g., via JSON.stringify or by escaping backticks and `${` sequences) rather than interpolating them directly into template literals. Patch available in version 8.21.0.
Affected products
- orval-labs orval < 8.21.0
Timeline
- 2026-09-03: disclosed: Published on GitHub Advisory Database
- 2026-09-03: patched: Version 8.21.0 released with fix (commit 8ef1bfd)
- 2026-08-19: kev added: Published on NVD