Executive brief
Orval is a code generator that produces TypeScript schema validation code (zod) from OpenAPI specifications. When processing query parameter default values, Orval directly injects them into template literals without escaping special characters. An attacker can craft a malicious OpenAPI specification with a default value containing JavaScript expressions (e.g., `v${malicious_code}w`) that execute immediately when the generated schema module is imported into any application, bypassing all runtime protections and allowing full code execution before any application code runs.
Technical details
The vulnerability is a template literal injection (CWE-1336) in Orval's zod code generator. When processing OpenAPI specifications, Orval emits default values using the pattern `export const …Default = `<default value>`;` without escaping backticks or the `${` sequence. An attacker can inject a query parameter with a default of `v${<attacker JS>}w`, where the `${…}` syntax triggers JavaScript expression evaluation at module parse time. This executes during the import statement before any application logic runs, granting the attacker immediate code execution with the full privileges of the importing process. The attack requires the attacker to influence or control the OpenAPI specification fed to Orval (e.g., via a compromised API definition file or man-in-the-middle attack on the spec download). The fix, available in version 8.21.0, properly escapes or encodes all default values using JSON.stringify or equivalent string-literal encoding to prevent template expression injection.
Affected products
- orval-labs orval < 8.21.0
Timeline
- 2026-09-02: disclosed: GitHub Advisory GHSA-p4cg-3328-rvfg published
- 2026-09-02: patched: Fix released in Orval 8.21.0