Listen to this Post
Orval’s zod schema generator creates module-level template literals for default values. These are emitted as export const …Default =v${…}w; without escaping. The `${…}` syntax is a JavaScript expression placeholder. When the generated module is imported, the template literal is evaluated. This evaluation executes the arbitrary JavaScript code inside ${...}. No function call, no HTTP request, and no user interaction is required. The vulnerability is triggered at the very moment the module is loaded. A malicious default value, e.g., v${globalThis.ORVPWN()}w, will execute ORVPWN. Orval’s default OpenAPI validation does not flag or block such payloads. The issue is confirmed on Orval version 8.19.0. The vulnerable pattern exists across multiple default-bearing positions. Header parameters, query parameters, and request body fields all share the same sink. An attacker who controls the OpenAPI specification can exploit this. The attacker can inject any JavaScript expression to gain code execution. This includes child processes, filesystem operations, or network exfiltration. The supplied PoC uses `reproduce.sh` and `make_spec.py` to demonstrate this. The PoC generates a malicious spec, runs Orval, and bundles the output. Importing the bundled module writes a marker to the filesystem. This proves that arbitrary code runs at import time. A single fix, such as proper string literal encoding, closes all vectors. Using `JSON.stringify(defaultValue)` would render the payload inert. Alternatively, escaping backticks and `${}` inside template literals would work. However, the safest approach is to avoid template literals altogether. The vulnerability represents a severe supply-chain risk. Any CI/CD pipeline using Orval on untrusted specs is compromised. Developers must treat OpenAPI inputs as untrusted. The impact is immediate and does not require runtime interaction. Orval’s maintainers have been notified and are expected to patch. Until then, manual sanitization of defaults is essential. This issue highlights the dangers of dynamic code generation.
DailyCVE Form:
Platform: Orval
Version: 8.19.0
Vulnerability : Template Literal Injection
Severity: Critical
date: 2026-09-03
Prediction: 2026-09-15
What Undercode Say:
Reproduce with provided scripts
./reproduce.sh
Examine generated Zod schema for vulnerable exports
cat generated/schemas.ts | grep "Default ="
Detect vulnerable pattern across the project
grep -r "export const .Default = <code>" src/
Simulate import trigger in Node.js (ESM)
node -e "import('./generated/schemas.js')"
Example make_spec.py snippet to inject payload
echo "default: 'v\${globalThis.ORVPWN()}w'" > malicious_spec.yaml
<h2 style=”color: blue;”>Exploit: (Educational Purposes!)</h2>
1. Craft an OpenAPI YAML file containing a header parameter withdefault: “v${globalThis.ORVPWN()}w”.import { headerDefault } from ‘./schemas’
2. Define `globalThis.ORVPWN = () => require('fs').writeFileSync('/tmp/pwned','exploited')` in the target environment.
3. Execute `npx orval --input malicious.yaml --output ./schemas` to generate the Zod module.
4. In the application, write.${globalThis.ORVPWN()}
5. Upon import, the template literal evaluates, writing `/tmp/pwned` and proving RCE at import. “ in every default field.
<h2 style="color: blue;">Protection: from this CVE</h2>
- Pre‑process all OpenAPI specs to escape `${` to `\${` and backtick to `` \
– Patch the Orval generation step to wrap default values with `JSON.stringify(defaultValue)` instead of direct interpolation.
– Avoid running Orval against untrusted or third‑party OpenAPI documents.
– Implement a custom transformation hook in the build pipeline that sanitizes defaults before code generation.
– Monitor the Orval repository and apply the official security patch immediately upon release.
Impact:
- Remote Code Execution (RCE) at build‑time or module import‑time without any user action.
- Full compromise of developer environments, build servers, and CI/CD agents running the generation.
- Theft of source code, environment secrets, and cryptographic keys from the build context.
- Insertion of persistent backdoors into production bundles through the generated schemas.
- Supply‑chain contamination if the OpenAPI source is pulled from an external or compromised registry.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
