EUVD-2026-62604Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Spec is attacker-controllable over the network (AV:N) but the victim must run codegen and import the generated module (UI:R); no auth needed (PR:N) and arbitrary code execution yields full C/I/A impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a double quote in a query parameter name is emitted into the generated request-validation zod.object({...}) schema without safe encoding. This permits attacker-controlled JavaScript to be evaluated when the generated zod schema module is imported, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/zod/src/index.ts and query request-validation generation. This issue is fixed in version 8.21.0.
AnalysisAI
Code injection in Orval before 8.21.0 lets an attacker-controlled OpenAPI v3 / Swagger v2 specification achieve arbitrary code execution: a double-quote character in a query parameter name is written verbatim into the generated request-validation zod.object({...}) schema, so importing that generated module evaluates embedded JavaScript. Any developer workstation, CI runner, test harness, or application that generates a zod client from a malicious or tampered spec is affected. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires that the victim run Orval (version < 8.21.0) with the zod validation/client generation target against an OpenAPI v3 or Swagger v2 spec whose query-parameter name contains a double-quote character plus attacker JavaScript, AND that the resulting generated zod schema module then be imported or executed (which normally happens during build, test, or app startup). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, score 9.3) treats this as network-reachable, low-complexity, unauthenticated, high-impact code execution. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker publishes or tampers with an OpenAPI spec so that a query parameter is named with an embedded double quote and JavaScript payload; a developer or CI pipeline generates a zod client from that spec with Orval, and as soon as the generated validation module is imported the injected code runs with the developer's or build agent's privileges. Because the payload executes at import time in the build/test environment, it can exfiltrate CI secrets or poison downstream artifacts. … |
| Remediation | Vendor-released patch: 8.21.0 - upgrade the orval dev dependency to 8.21.0 or later (release notes: https://github.com/orval-labs/orval/releases/tag/v8.21.0; advisory: https://github.com/orval-labs/orval/security/advisories/GHSA-653q-5476-x79g; fix in PR https://github.com/orval-labs/orval/pull/3692 and commit 8ef1bfdf3f9bcaf9dabfbe2e42887f1c0e159ab6). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify all development environments and CI/CD runners using Orval, audit current API specification files for unauthorized modifications, and restrict specification sources to internal trusted repositories. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
orval (TypeScript API client generator) before 7.18.0 has code injection via OpenAPI specification summary fields in MCP
Orval TypeScript code generator versions 7.19+ have a command injection vulnerability allowing RCE through malicious Ope
Orval, a TypeScript API client generator, has a command injection vulnerability that allows code execution through malic
Code injection in Orval TypeScript API client generator versions 7.19.0 to before 7.22.0. Generated client code may be v
Arbitrary code execution in Orval before 8.21.0 arises when the code generator emits an unescaped backtick (or ${...}) f
Arbitrary code execution in Orval (orval-labs/orval) before 8.21.0 allows an attacker who controls an OpenAPI v3 or Swag
Code injection in Orval, a TypeScript/JavaScript API client generator, allows a malicious OpenAPI v3 or Swagger v2 speci
Code execution in Orval before 8.21.0 occurs when its zod schema generator processes an attacker-controlled OpenAPI v3 o
Arbitrary code execution in Orval (OpenAPI/Swagger TypeScript client generator) before 8.21.0 lets an attacker who contr
Code injection in Orval (orval-labs/orval) before 8.21.0 allows an attacker who controls an OpenAPI v3 or Swagger v2 spe
Code injection in Orval, a TypeScript client generator for OpenAPI v3 and Swagger v2 specs, allows arbitrary JavaScript
Code injection in Orval before 8.21.0 lets an attacker-controlled OpenAPI v3 or Swagger v2 specification execute arbitra
Same weakness CWE-94 – Code Injection
View allSame technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today