GHSA-2h9g-j24r-h63g: Code Injection
Summary
Orval's zod schema generation emits the array-items default value as a module-level template literal (export const …Default = <default>;) without escaping ${ or the backtick. A default of the form v${<code>}w injects a live JavaScript expression evaluated when the generated zod schema module is imported, executing attacker-controlled code at import — no request or function call needed. Verified on Orval 8.19.0; survives default OpenAPI validation.
Details
ts export const …Default = v${globalThis.ORVPWN()}w; // ${...} = arbitrary JS expression, runs at import
Malicious input: an array property (string items) with a default of v${<attacker JS>}w. ${...} permits any JS expression.
Note: this is one of several default-bearing positions that reach the same unescaped zod template-literal sink; a single fix (escape default values) closes all of them, and a CNA may choose to consolidate the related reports.
PoC
reproduce.sh (+ makespec.py) attached: generates the zod schema with default validation, bundles it, imports it, and shows a marker written at import. Verified on 8.19.0.
Impact
Code execution at import in any application that imports a zod schema module generated from an attacker-controlled or attacker-influenced OpenAPI description.
Suggested fix
Emit default values via a proper string-literal encoder (JSON.stringify, or escape backtick and ${ if a template literal must be used); never interpolate a spec value into a template literal. Apply to every default position. maintainer-report.txt makespec.pyreproduce.sh
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/orvalto a version that resolves this vulnerability.Fixed in 8.21.0 - Upgrade
Upgrade
Orvalto a version that resolves this vulnerability.Fixed in 8.19.0 - Configuration
Update Orval’s zod schema generator so that any OpenAPI `default` value emitted into a module-level template literal (e.g., `export const …Default = `<default>`;`) does not allow `${...}` interpolation. Specifically, emit `default` values using a proper string-literal encoder such as `JSON.stringify`, or if a template literal must be used, escape backticks and the `${` sequence in the generated output (e.g., replace backtick with escaped form and replace `${` with an escaped/non-interpolating representation). This mitigates code execution at import from attacker-influenced OpenAPI defaults (including the array-items default).
Orval (zod schema generation) escaping of OpenAPI default values in module-level template literals = escape `${` and backticks in emitted default strings (e.g., emit via JSON.stringify, or escape backtick and `${` if using a template literal)
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications are exposed if they generate Orval zod schemas from an OpenAPI document containing attacker-controlled default values and later import the generated schema module. The malicious default must be on string array items; related default-bearing positions may also reach the same sink.
What does an attacker need to control?
An attacker needs to supply or modify an OpenAPI default value that reaches Orval's zod schema generator. A string such as v${<attacker JavaScript>}w in an array item's default value can inject an arbitrary JavaScript expression.
Is default OpenAPI validation sufficient to block the payload?
No. The issue was verified to survive default OpenAPI validation.
When does the injected code run?
The expression is evaluated when the generated zod schema module is imported. No HTTP request or application function call is required after import.