Orval vulnerabilities

Orval (prior to 8.21.0) generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. A ${...} expression or backtick in a schema default is emitted into a module-level template literal without safe encoding, allowing attacker-controlled JavaScript to be evaluated when the generated zod schema module is imported, resulting in code execution in the developer, CI, test, or application environment.

Orval (prior to 8.21.0) generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. A ${...} expression or backtick in a query parameter default is emitted into a module-level template literal without safe encoding, allowing attacker-controlled JavaScript to be evaluated when the generated zod schema module is imported, resulting in code execution in the developer, CI, test, or application environment.

Orval (prior to 8.21.0) generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. A ${...} expression or backtick in a header parameter default is emitted into a module-level template literal without safe encoding, allowing attacker-controlled JavaScript to be evaluated when the generated zod schema module is imported, resulting in code execution in the developer, CI, test, or application environment.

Orval (prior to 8.21.0) generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. A ${...} expression or backtick in an array item default is emitted into a module-level template literal without safe encoding, allowing attacker-controlled JavaScript to be evaluated when the generated zod schema module is imported, resulting in code execution in the developer, CI, test, or application environment.

Orval before 8.21.0 unsafely encodes ${...} expressions or backticks in enum defaults in generated zod schemas, allowing malicious JavaScript execution when the module is imported.

Orval before 8.21.0 unsafely encodes single quotes in schema property names in generated MSW mock factories, allowing malicious JavaScript execution when the factory is called.

Orval from 8.19.0 to 8.21.0 unsafely encodes double quotes in schema property names in generated zod.object({...}) schemas, allowing malicious JavaScript execution when the module is imported.

Orval before 8.21.0 unsafely encodes double quotes in query parameter names in generated request-validation zod.object({...}) schemas, allowing malicious JavaScript execution when the module is imported.

Orval before 8.21.0 unsafely encodes double quotes in header parameter names in generated request-validation zod.object({...}) schemas, allowing malicious JavaScript execution when the module is imported.

Orval before 8.21.0 unsafely encodes unescaped backticks in servers[0].url in generated request URL template literals when output.baseUrl.getBaseUrlFromSpecification is enabled, allowing malicious JavaScript execution when a generated function is called.

Orval before 8.21.0 unsafely encodes unescaped backticks in OpenAPI paths in generated request URL template literals for axios, fetch, react-query, and SWR clients, allowing malicious JavaScript execution when a generated function is called.

Orval before 8.22.0 resolves external $ref values without an allowlist or confinement to the input directory. Processing an attacker-controlled OpenAPI specification can cause requests to attacker-selected HTTP services, read local files outside the project tree, and inline untrusted schemas into generated clients.