EUVD-2026-62605
GHSA-3575-w9fc-c2j6
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attacker needs no privileges, but the victim must run codegen against a malicious spec and import the output, so UI:R; full unsandboxed RCE gives C/I/A:H with no scope change.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a ${...} expression or backtick in an enum default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permits attacker-controlled JavaScript to be evaluated when the generated zod schema module is imported, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/zod/src/index.ts function formatDefaultValue. This issue is fixed in version 8.21.0.
AnalysisAI
Code execution in Orval before 8.21.0 occurs when its zod schema generator processes an attacker-controlled OpenAPI v3 or Swagger v2 specification: a ${...} expression or backtick placed in an enum default value is written unescaped into a module-level JavaScript template literal, so simply importing the generated schema module evaluates the attacker's code in the developer, CI, test, or application runtime. This is a CWE-94 code-injection flaw (CVSS 9.3) affecting the packages/zod/src/index.ts formatDefaultValue routine. No CISA KEV listing and no separately published exploit exist at time of analysis, though the vendor's fix commit ships tests containing working injection payloads.
Technical ContextAI
Orval is a TypeScript client generator that turns OpenAPI/Swagger definitions into type-safe clients and validation schemas, including a zod target. In JavaScript, template literals delimited by backticks interpolate any ${...} expression they contain and execute it at evaluation time. The vulnerable formatDefaultValue function emitted enum default values directly into such a module-level template literal without escaping backticks, backslashes, or ${...} sequences, so spec-supplied text was treated as live code rather than inert string data. This is a classic CWE-94 (Improper Control of Generation of Code) sink: untrusted input crosses into a code-generation context. The upstream fix (PR #3692) introduces the jsesc library and a jsStringLiteralEscape helper to safely encode spec-sourced strings across related sinks (enum defaults, object keys, route/server URLs).
RemediationAI
Vendor-released patch: upgrade Orval to 8.21.0 or later, which escapes spec-sourced values via jsesc before emitting them into generated code (fix in PR https://github.com/orval-labs/orval/pull/3692 and commit https://github.com/orval-labs/orval/commit/8ef1bfdf3f9bcaf9dabfbe2e42887f1c0e159ab6; advisory https://github.com/orval-labs/orval/security/advisories/GHSA-3575-w9fc-c2j6). Until upgraded, treat every OpenAPI/Swagger spec as untrusted input: source specs only from first-party, access-controlled locations and pin/verify their integrity, which prevents attacker injection but does not help if an upstream vendor spec is itself compromised. As additional compensating controls, run Orval codegen in a sandboxed or ephemeral CI job with no secrets and restricted network/filesystem access to limit blast radius, and code-review generated zod modules (grep for unexpected backticks or ${...} in default values) before importing or building them - the trade-off being added pipeline friction and reviewer burden.
orval (TypeScript API client generator) before 7.18.0 has code injection via OpenAPI specification summary fields in MCP
Arbitrary code execution in Orval (orval-labs/orval) before 8.21.0 allows an attacker who controls an OpenAPI v3 or Swag
Code injection in Orval before 8.21.0 lets an attacker-controlled OpenAPI v3 or Swagger v2 specification execute arbitra
Code injection in Orval before 8.21.0 lets an attacker who controls an OpenAPI v3 or Swagger v2 specification embed exec
Arbitrary code execution in Orval before 8.21.0 arises when the code generator emits an unescaped backtick (or ${...}) f
Code injection in Orval, a TypeScript/JavaScript API client generator, allows a malicious OpenAPI v3 or Swagger v2 speci
Code injection in Orval before 8.21.0 lets an attacker-controlled OpenAPI v3 / Swagger v2 specification achieve arbitrar
Arbitrary code execution in Orval (OpenAPI/Swagger TypeScript client generator) before 8.21.0 lets an attacker who contr
Code injection in Orval (orval-labs/orval) before 8.21.0 allows an attacker who controls an OpenAPI v3 or Swagger v2 spe
Code injection in Orval, a TypeScript client generator for OpenAPI v3 and Swagger v2 specs, allows arbitrary JavaScript
I analyzed the provided intelligence and produced the synthesis below. One thing to flag first: **⚠️ Prompt-injection n
External $ref resolution in Orval prior to version 8.22.0 allows server-side request forgery and path traversal against
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today