GHSA-3575-w9fc-c2j6: Code Injection
Summary
Orval's zod schema generation emits the enum-typed default value as a module-level template literal (export const …Default = <default>;) without escaping ${ or the backtick. A default of the form v${<code>}w injects a live JavaScript expression evaluated when the generated zod schema module is imported, executing attacker-controlled code at import — no request or function call needed. Verified on Orval 8.19.0; survives default OpenAPI validation.
Details
ts export const …Default = v${globalThis.ORVPWN()}w; // ${...} = arbitrary JS expression, runs at import
Malicious input: an enum-typed property with a default of v${<attacker JS>}w. ${...} permits any JS expression.
Note: this is one of several default-bearing positions that reach the same unescaped zod template-literal sink; a single fix (escape default values) closes all of them, and a CNA may choose to consolidate the related reports.
PoC
reproduce.sh (+ makespec.py) attached: generates the zod schema with default validation, bundles it, imports it, and shows a marker written at import. Verified on 8.19.0.
Impact
Code execution at import in any application that imports a zod schema module generated from an attacker-controlled or attacker-influenced OpenAPI description.
Suggested fix
Emit default values via a proper string-literal encoder (JSON.stringify, or escape backtick and ${ if a template literal must be used); never interpolate a spec value into a template literal. Apply to every default position.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/orvalto a version that resolves this vulnerability.Fixed in 8.21.0 - Upgrade
Upgrade
Orvalto a version that resolves this vulnerability.Fixed in 8.19.0 - Configuration
In the Orval-generated Zod schema module, ensure enum-typed `default` values are not emitted as unescaped module-level template literals like `export const …Default = `<default>`;` . Emit defaults via proper string-literal encoding (e.g., JSON.stringify), or if a template literal must be used, escape backticks and the `${` sequence (so `${...}` is not treated as a live JavaScript expression at import). Apply this fix to every `default` position that flows into the unescaped Zod template-literal sink.
Orval zod schema generation (default values) Template-literal escaping for exported *Default values = Escape ${ and backticks so that default values are emitted as proper string literals (e.g., use JSON.stringify; or escape backtick and ${ if using template literals)
Event History
Frequently Asked Questions
What must an attacker control to trigger this issue?
The attacker needs to supply or influence an OpenAPI specification containing an enum-typed property whose default value includes a sequence such as v${<attacker JavaScript>}w. The injected content is emitted as a JavaScript template literal expression in the generated zod schema.
When does the injected code run?
It runs when the generated zod schema module is imported. No request handling or application function call is required after the module is imported.
Will normal OpenAPI validation reject a malicious default value?
No. The described malicious default value survives default OpenAPI validation.
How can generated output be checked for exposure?
Inspect generated zod schema modules for module-level exported default constants emitted as template literals. A default containing unescaped ${ or a backtick can produce executable JavaScript when the module is imported.
What change addresses the affected default-value paths?
Escaping default values before they are emitted into the zod template-literal sink closes the related default-bearing positions described in the advisory.