CVE-2026-71867: Orval: RCE via schema property name -> computed-property-key injection in the MSW mock generator
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a single quote in a schema property name is emitted into single-quoted object keys in generated MSW mock factories without safe encoding. This permits attacker-controlled JavaScript to be evaluated when the generated mock factory is called by tests or an MSW handler, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/core/src/getters/keys.ts function getKey and MSW mock generation. This issue is fixed in version 8.21.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Orvalto a version that resolves this vulnerability.Fixed in 8.21.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of Orval versions before 8.21.0 are exposed if they generate MSW mocks from an OpenAPI or Swagger specification containing attacker-controlled schema property names. The generated code executes when the affected mock factory is called by tests or an MSW handler, potentially affecting developer workstations, CI, test, or application environments.
What does an attacker need to exploit it?
An attacker needs influence over a schema property name in the OpenAPI v3 or Swagger v2 input used to generate MSW mocks. A single quote in that property name can inject JavaScript into a generated single-quoted object key.
How can I determine whether generated output is affected?
Review generated MSW mock factories for schema-derived object keys containing unescaped single quotes or unexpected JavaScript. The affected generation path includes packages/core/src/getters/keys.ts, specifically getKey, and MSW mock generation.
What is the remediation?
Upgrade Orval to version 8.21.0, which fixes the issue. Regenerate affected MSW mock output after upgrading so previously generated vulnerable code is replaced.