Executive brief
Orval is a popular code generator that creates TypeScript validation schemas from OpenAPI specifications. The tool contains a critical flaw where it fails to properly escape default values when generating zod validation modules, allowing an attacker who controls or influences an OpenAPI schema to inject and execute arbitrary JavaScript code when the generated schema is imported into an application. This gives attackers complete system access the moment a developer's build process imports the compromised schema—no user interaction or API request required.
Technical details
The vulnerability is a code injection flaw (CWE-94, CWE-116, CWE-1336) in Orval's zod schema generation. Default values are emitted as backtick-quoted template literals (e.g., `export const getIResponseDsDefault = \`<default>\`;`) without escaping `${` or backticks. An attacker-supplied default value of the form `v${globalThis.ORVPWN()}w` injects a live JavaScript expression that is evaluated at module import time, not at runtime or on function call. While Orval properly escapes other value sinks (enum, mock, regex, object defaults) using `\'` in single-quoted strings, the `default` field is uniquely emitted as a template literal, making it the only unescaped injection point. The attack requires either an attacker-controlled OpenAPI schema or influence over a schema used by the target application (e.g., via supply-chain compromise). No authentication, privileges, or user interaction are required. The fix is to encode default values using JSON.stringify or to escape backticks and `${` sequences if template literals are used.
Affected products
- orval-labs orval < 8.21.0
Timeline
- 2026-09-03: disclosed: Published by GitHub Advisory Database
- 2026-09-03: patched: Version 8.21.0 released with fix
- 2026-07-12: advisory: Published to repository advisory
- 2026-08-19: other: Published to National Vulnerability Database