EUVD-2026-62657
GHSA-w727-8j6c-2rj4
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Untrusted spec is remotely fetchable and needs no auth or privileges (AV:N/AC:L/PR:N); import during CI/build is routine so UI:N; injected code fully compromises the host process (C/I/A:H, S:U).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a ${...} expression or backtick in a schema default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permits attacker-controlled JavaScript to be evaluated when the generated zod schema module is imported, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/zod/src/index.ts function formatDefaultValue. This issue is fixed in version 8.21.0.
AnalysisAI
Arbitrary code execution in Orval (orval-labs/orval) before 8.21.0 allows an attacker who controls an OpenAPI v3 or Swagger v2 specification to run JavaScript in the developer, CI, test, or application environment that generates or imports the resulting client. The flaw lives in the zod schema generator (packages/zod/src/index.ts, formatDefaultValue), which emits a schema default value containing a ${...} interpolation or backtick into a module-level template literal without safe encoding, so the payload is evaluated the moment the generated module is loaded. It is fixed in 8.21.0; there is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the vendor advisory and fixing PR include demonstrative injection payloads.
Technical ContextAI
Orval is a code generator that turns OpenAPI/Swagger contracts into type-safe TypeScript API clients and, optionally, zod validation schemas. The root cause is CWE-94 (Improper Control of Generation of Code / code injection): when generating zod schemas, Orval copies a schema's default value verbatim into emitted TypeScript that is wrapped in a JavaScript template literal (backtick string). Because template literals evaluate any ${...} expression and honor embedded backticks, an untrusted default such as ${require('child_process').execSync('id')} becomes live code in the generated module rather than inert data. The fix introduces the jsesc library (and a jsStringLiteralEscape/getKey helper) to safely escape backticks, ${ sequences, and backslashes before interpolation, and the same PR (#3692) hardens sibling sinks including server URL and route path generation (getFullRoute/getRoute, GHSA-88f2-fpv8-89q2). The single affected CPE is cpe:2.3:a:orval-labs:orval:*:*:*:*:*:*:*:*.
RemediationAI
Vendor-released patch: 8.21.0 - upgrade Orval to 8.21.0 or later, which escapes untrusted default/URL/path values via jsesc before they are emitted into template literals (fix in PR https://github.com/orval-labs/orval/pull/3692 and commit 8ef1bfdf3f9bcaf9dabfbe2e42887f1c0e159ab6, advisory https://github.com/orval-labs/orval/security/advisories/GHSA-w727-8j6c-2rj4). If you cannot upgrade immediately, only run Orval against OpenAPI/Swagger specifications you fully trust and control - do not point generation at attacker-influenced or third-party-hosted spec URLs, since that removes the attacker-controlled input entirely (trade-off: blocks legitimate consumption of external specs). As additional hardening, run client generation and the subsequent module import inside an isolated, least-privilege CI/sandbox with no secrets or network egress so any injected code has minimal blast radius (trade-off: added pipeline complexity), and review generated zod modules for stray unescaped ${ or backtick sequences before committing them.
orval (TypeScript API client generator) before 7.18.0 has code injection via OpenAPI specification summary fields in MCP
Code injection in Orval before 8.21.0 lets an attacker-controlled OpenAPI v3 or Swagger v2 specification execute arbitra
Code injection in Orval before 8.21.0 lets an attacker who controls an OpenAPI v3 or Swagger v2 specification embed exec
Arbitrary code execution in Orval before 8.21.0 arises when the code generator emits an unescaped backtick (or ${...}) f
Code injection in Orval, a TypeScript/JavaScript API client generator, allows a malicious OpenAPI v3 or Swagger v2 speci
Code execution in Orval before 8.21.0 occurs when its zod schema generator processes an attacker-controlled OpenAPI v3 o
Code injection in Orval before 8.21.0 lets an attacker-controlled OpenAPI v3 / Swagger v2 specification achieve arbitrar
Arbitrary code execution in Orval (OpenAPI/Swagger TypeScript client generator) before 8.21.0 lets an attacker who contr
Code injection in Orval (orval-labs/orval) before 8.21.0 allows an attacker who controls an OpenAPI v3 or Swagger v2 spe
Code injection in Orval, a TypeScript client generator for OpenAPI v3 and Swagger v2 specs, allows arbitrary JavaScript
I analyzed the provided intelligence and produced the synthesis below. One thing to flag first: **⚠️ Prompt-injection n
External $ref resolution in Orval prior to version 8.22.0 allows server-side request forgery and path traversal against
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today