EUVD-2026-62603
GHSA-2h9g-j24r-h63g
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Spec can be remote (AV:N) and payload is simple (AC:L, PR:N), but a developer/CI must consume the spec and import output (UI:R); generated code runs in a different context than the tool (S:C) with full code execution (C/I/A:H).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a ${...} expression or backtick in an array item default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permits attacker-controlled JavaScript to be evaluated when the generated zod schema module is imported, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/zod/src/index.ts function formatDefaultValue. This issue is fixed in version 8.21.0.
AnalysisAI
Arbitrary code execution in Orval (OpenAPI/Swagger TypeScript client generator) before 8.21.0 lets an attacker who controls an OpenAPI v3 or Swagger v2 specification inject JavaScript that runs when the generated zod schema module is imported. A ${...} template expression or backtick placed in an array item's default value is emitted verbatim into a module-level template literal by formatDefaultValue in packages/zod/src/index.ts, so importing the generated code executes attacker payloads in the developer, CI, test, or application environment. No CISA KEV listing exists, but the fixing PR (#3692) ships tests demonstrating concrete injection payloads such as backtick-plus-require('child_process').execSync('id'), so working exploit technique is effectively public; EPSS was not provided.
Technical ContextAI
Orval is a build-time code generator that turns OpenAPI v3 / Swagger v2 specs into type-safe TypeScript API clients and zod validation schemas. The flaw is a classic CWE-94 code injection: when generating zod schemas, formatDefaultValue serializes an array item's default value into JavaScript source using a template literal (backtick string). Because the value is interpolated without JavaScript string-literal escaping, any ${...} interpolation sequence or raw backtick in the spec breaks out of the intended string and becomes live code in the emitted module. The broader fix (GHSA-88f2-fpv8-89q2 / GHSA-2h9g-j24r-h63g) also hardens related sinks - object keys (getKey), route paths (getRoute), and server URLs/variable defaults (getFullRoute) - by routing untrusted values through a jsStringLiteralEscape helper (the jsesc library). The affected product per CPE is cpe:2.3:a:orval-labs:orval, all versions below 8.21.0.
RemediationAI
Vendor-released patch: upgrade Orval to 8.21.0 or later, which escapes untrusted spec-sourced strings via a jsStringLiteralEscape/jsesc helper before emitting them into generated JavaScript (fix commit 8ef1bfdf3f9bcaf9dabfbe2e42887f1c0e159ab6, PR https://github.com/orval-labs/orval/pull/3692, advisory https://github.com/orval-labs/orval/security/advisories/GHSA-2h9g-j24r-h63g). If you cannot upgrade immediately, treat every OpenAPI/Swagger spec as untrusted input: only run Orval against specs from sources you fully control, and manually review array item default values, object keys, path segments, and server URLs/variables for backticks or ${...} sequences before generation - the trade-off is manual overhead and no guarantee against obfuscated payloads. As a stronger compensating control, run Orval generation inside a sandboxed/ephemeral CI job with no secrets and no network egress, and inspect or diff the generated modules before any import or execution, since the payload only fires when the generated code is imported. Do not invent or apply unofficial patched version numbers beyond the confirmed 8.21.0.
orval (TypeScript API client generator) before 7.18.0 has code injection via OpenAPI specification summary fields in MCP
Arbitrary code execution in Orval (orval-labs/orval) before 8.21.0 allows an attacker who controls an OpenAPI v3 or Swag
Code injection in Orval before 8.21.0 lets an attacker-controlled OpenAPI v3 or Swagger v2 specification execute arbitra
Code injection in Orval before 8.21.0 lets an attacker who controls an OpenAPI v3 or Swagger v2 specification embed exec
Arbitrary code execution in Orval before 8.21.0 arises when the code generator emits an unescaped backtick (or ${...}) f
Code injection in Orval, a TypeScript/JavaScript API client generator, allows a malicious OpenAPI v3 or Swagger v2 speci
Code execution in Orval before 8.21.0 occurs when its zod schema generator processes an attacker-controlled OpenAPI v3 o
Code injection in Orval before 8.21.0 lets an attacker-controlled OpenAPI v3 / Swagger v2 specification achieve arbitrar
Code injection in Orval (orval-labs/orval) before 8.21.0 allows an attacker who controls an OpenAPI v3 or Swagger v2 spe
Code injection in Orval, a TypeScript client generator for OpenAPI v3 and Swagger v2 specs, allows arbitrary JavaScript
I analyzed the provided intelligence and produced the synthesis below. One thing to flag first: **⚠️ Prompt-injection n
External $ref resolution in Orval prior to version 8.22.0 allows server-side request forgery and path traversal against
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today