GHSA-6mr6-jvcr-2f25: SQL Injection
Summary
orval's zod client emits each schema property name as a double-quoted key in the generated zod.object({...}) WITHOUT escaping the double quote. A " in a property name closes the key and lands in object-literal context, where an injected computed property key [expr] is evaluated when zod.object({...}) runs -- which is at MODULE IMPORT (the export const X = zod.object({...}) executes on load) -> import-time RCE. The property name is a pure data field. Verified on orval 8.19.0 / Node. CWE-94 / CWE-95 / CWE-116.
Details
ts export const OpBody = zod.object({ "a":zod.string(),[require("fs").writeFileSync("PWNED","")]:zod.string(),"b": zod.string().optional() })
Sibling: the MSW mock uses a single-quoted key (' breakout, call-time) -- separate report. The TS interface key is a type (DoS only). Distinct from orval's $ref / route-path / server-url / zod-default findings.
PoC
reproduce.sh (+ makespec.py) attached: a property name a":zod.string(),[require("fs").writeFileSync("<marker>","")]:zod.string(),"b -> zod.object; evaluating it (= importing the module) writes the marker. Verified on 8.19.0.
Impact
JavaScript / OS command execution (via childprocess) at import time for anyone who generates an orval zod client from an attacker-controlled spec and imports it. Estimated Critical, e.g. CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N.
Suggested fix
Escape the property name for the JS string key (JSON.stringify) in the zod.object key generation; never interpolate a raw property name adjacent to [ ] in object-literal position. maintainer-report.txt makespec.py reproduce.sh
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/orvalto a version that resolves this vulnerability.Fixed in 8.21.0 - Upgrade
Upgrade
orvalto a version that resolves this vulnerability.Fixed in 8.19.0 - Configuration
In the generated zod.object({...}) object-literal, escape the property name when emitting the JS string key so that embedded " characters can’t break out of the key context. Concretely: generate the key using JSON.stringify and never emit a raw property name adjacent to [ ] in object-literal position without escaping.
orval zod client generator escaping of JSON string keys for zod.object property names = escape double quotes in property names when generating JavaScript object literal keys (e.g., use JSON.stringify for the JS string key)
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users who generate and then import Orval Zod client code from an API specification containing attacker-controlled property names are exposed. The vulnerable property name is treated as data in the specification but is emitted into executable JavaScript object-literal syntax.
What must an attacker control to exploit it?
An attacker needs control over a schema property name in the API specification. By including a double quote and injected computed property expression, they can cause code to execute when the generated module is imported.
When does the injected code execute?
Execution occurs at module import time, because the generated zod.object({...}) expression runs as the exported schema is initialized. The proof of concept demonstrates file creation during import, and the impact includes JavaScript or OS command execution through child_process.
Is a known affected version identified?
The issue was verified on Orval 8.19.0 with Node. No fixed version is provided in the available data.