Orval vulnerabilities

orval before 8.29.0 fails to escape the operationId parameter when emitting it into generated TanStack Query mutator options metadata objects. Attackers can inject arbitrary JavaScript code through a crafted operationId in an OpenAPI specification that executes when generated hooks are called.

orval @orval/core before 8.28.0 contains a code injection vulnerability in the form-data serializer that fails to escape multipart property names in generated template literals. Attackers can inject ${...} expressions into OpenAPI schema property names that execute as live interpolation when the generated client builds FormData bodies with consumer process privileges.

orval before 8.29.0 fails to escape OpenAPI media-type keys when emitting them into single-quoted Content-Type string literals in generated code. Attackers can inject JavaScript through crafted media-type keys in OpenAPI specifications that executes when generated fetch operations or mock resolvers are invoked.

orval versions 8.14.0 through 8.28.1 contain a code injection vulnerability in the @orval/effect generator that converts OpenAPI schema defaults into template literals. Attackers can inject arbitrary JavaScript expressions via schema defaults containing ${...} syntax, which are executed at module scope when the generated code is built or imported.

orval versions before 8.29.0 contain a code injection vulnerability in the @orval/hono generator that fails to escape OpenAPI path values in single-quoted route literals. Attackers can craft an OpenAPI document with an apostrophe in a static path segment to inject arbitrary JavaScript code that executes when the generated TypeScript module is imported.

Orval (prior to 8.21.0) generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. A ${...} expression or backtick in a schema default is emitted into a module-level template literal without safe encoding, allowing attacker-controlled JavaScript to be evaluated when the generated zod schema module is imported, resulting in code execution in the developer, CI, test, or application environment.

Orval (prior to 8.21.0) generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. A ${...} expression or backtick in a query parameter default is emitted into a module-level template literal without safe encoding, allowing attacker-controlled JavaScript to be evaluated when the generated zod schema module is imported, resulting in code execution in the developer, CI, test, or application environment.

Orval (prior to 8.21.0) generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. A ${...} expression or backtick in a header parameter default is emitted into a module-level template literal without safe encoding, allowing attacker-controlled JavaScript to be evaluated when the generated zod schema module is imported, resulting in code execution in the developer, CI, test, or application environment.

Orval (prior to 8.21.0) generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. A ${...} expression or backtick in an array item default is emitted into a module-level template literal without safe encoding, allowing attacker-controlled JavaScript to be evaluated when the generated zod schema module is imported, resulting in code execution in the developer, CI, test, or application environment.

Orval before 8.21.0 unsafely encodes ${...} expressions or backticks in enum defaults in generated zod schemas, allowing malicious JavaScript execution when the module is imported.

Orval before 8.21.0 unsafely encodes single quotes in schema property names in generated MSW mock factories, allowing malicious JavaScript execution when the factory is called.

Orval from 8.19.0 to 8.21.0 unsafely encodes double quotes in schema property names in generated zod.object({...}) schemas, allowing malicious JavaScript execution when the module is imported.

Orval before 8.21.0 unsafely encodes double quotes in query parameter names in generated request-validation zod.object({...}) schemas, allowing malicious JavaScript execution when the module is imported.

Orval before 8.21.0 unsafely encodes double quotes in header parameter names in generated request-validation zod.object({...}) schemas, allowing malicious JavaScript execution when the module is imported.

Orval before 8.21.0 unsafely encodes unescaped backticks in servers[0].url in generated request URL template literals when output.baseUrl.getBaseUrlFromSpecification is enabled, allowing malicious JavaScript execution when a generated function is called.

Orval before 8.21.0 unsafely encodes unescaped backticks in OpenAPI paths in generated request URL template literals for axios, fetch, react-query, and SWR clients, allowing malicious JavaScript execution when a generated function is called.

orval versions before 8.30.0 contain a code injection vulnerability in the @orval/core factory generator that fails to escape date default values in new Date() calls. Attackers can inject arbitrary expressions through apostrophes in OpenAPI schema defaults to execute code with the privileges of the consumer process when factoryMethods and useDates options are enabled.

Orval before 8.22.0 resolves external $ref values without an allowlist or confinement to the input directory. Processing an attacker-controlled OpenAPI specification can cause requests to attacker-selected HTTP services, read local files outside the project tree, and inline untrusted schemas into generated clients.