EUVD-2026-62607
GHSA-2w86-xfrc-g85r
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Malicious spec can be remote (AV:N) and trigger is trivial (AC:L, PR:N), but a developer/CI must generate and run the mocks, so UI:R; execution yields full C/I/A impact on that host.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a single quote in a schema property name is emitted into single-quoted object keys in generated MSW mock factories without safe encoding. This permits attacker-controlled JavaScript to be evaluated when the generated mock factory is called by tests or an MSW handler, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/core/src/getters/keys.ts function getKey and MSW mock generation. This issue is fixed in version 8.21.0.
AnalysisAI
Code injection in Orval, a TypeScript/JavaScript API client generator, allows a malicious OpenAPI v3 or Swagger v2 specification to achieve arbitrary code execution in developer, CI, test, or application environments when versions prior to 8.21.0 generate MSW mock factories. The getKey function in packages/core/src/getters/keys.ts wraps non-identifier schema property names in single-quoted object keys without escaping embedded single quotes, so an attacker-controlled property name can break out of the string literal and inject JavaScript that runs when the generated mock factory is invoked by tests or an MSW handler. No public exploit identified at time of analysis, and the issue is not in CISA KEV; a vendor patch (v8.21.0) is available.
Technical ContextAI
Orval is a code-generation tool that reads OpenAPI/Swagger specs and emits type-safe client code, including Mock Service Worker (MSW) mock factories. When a schema property name is not a valid ES5 identifier, getKey emitted it verbatim as '${key}' - a single-quoted JS object key. Because the key content was interpolated without JS string-literal escaping, a property name containing a single quote (e.g. x':[require('fs').execSync('id'),) terminates the intended string and lets the remainder be parsed as executable JavaScript in the generated source file. The root cause is improper neutralization of special elements when building generated code (classic code/eval injection, CWE-94/CWE-95). Note the assigned CWE-89 (SQL Injection) does not match the actual mechanism - this is JavaScript source injection, not SQL. The fix introduces a jsStringLiteralEscape helper (backed by the jsesc library) so quotes and backslashes are safely encoded; the same PR (#3692) also hardened related template-literal injection paths in server URLs and route paths (GHSA-88f2-fpv8-89q2), escaping backticks and ${} interpolation.
RemediationAI
Vendor-released patch: upgrade Orval to version 8.21.0 or later, which routes non-identifier keys through the new jsStringLiteralEscape/jsesc encoder (fix in PR https://github.com/orval-labs/orval/pull/3692, commit 8ef1bfdf3f9bcaf9dabfbe2e42887f1c0e159ab6, release https://github.com/orval-labs/orval/releases/tag/v8.21.0, advisory GHSA-2w86-xfrc-g85r). Until you can upgrade, treat OpenAPI/Swagger inputs as untrusted: only run Orval against specs you control or have reviewed, and reject or sanitize specs whose property names contain single quotes or backslashes (and, given the related GHSA-88f2-fpv8-89q2 fix, backticks or ${ sequences in server URLs and paths). As additional compensating controls, disable MSW mock generation if you do not need it (removes the primary sink but forgoes mock coverage), and run codegen plus generated tests inside a sandboxed, network-restricted CI job with least-privilege credentials so that any injected execution cannot reach secrets or production systems (trade-off: added CI complexity). Manually review generated code diffs before committing as a last-line check.
orval (TypeScript API client generator) before 7.18.0 has code injection via OpenAPI specification summary fields in MCP
Arbitrary code execution in Orval (orval-labs/orval) before 8.21.0 allows an attacker who controls an OpenAPI v3 or Swag
Code injection in Orval before 8.21.0 lets an attacker-controlled OpenAPI v3 or Swagger v2 specification execute arbitra
Code injection in Orval before 8.21.0 lets an attacker who controls an OpenAPI v3 or Swagger v2 specification embed exec
Arbitrary code execution in Orval before 8.21.0 arises when the code generator emits an unescaped backtick (or ${...}) f
Code execution in Orval before 8.21.0 occurs when its zod schema generator processes an attacker-controlled OpenAPI v3 o
Code injection in Orval before 8.21.0 lets an attacker-controlled OpenAPI v3 / Swagger v2 specification achieve arbitrar
Arbitrary code execution in Orval (OpenAPI/Swagger TypeScript client generator) before 8.21.0 lets an attacker who contr
Code injection in Orval (orval-labs/orval) before 8.21.0 allows an attacker who controls an OpenAPI v3 or Swagger v2 spe
Code injection in Orval, a TypeScript client generator for OpenAPI v3 and Swagger v2 specs, allows arbitrary JavaScript
I analyzed the provided intelligence and produced the synthesis below. One thing to flag first: **⚠️ Prompt-injection n
External $ref resolution in Orval prior to version 8.22.0 allows server-side request forgery and path traversal against
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today