GHSA-6mr6-jvcr-2f25: SQL Injection

Published Sep 2, 2026
·
Updated

Summary

orval's zod client emits each schema property name as a double-quoted key in the generated zod.object({...}) WITHOUT escaping the double quote. A " in a property name closes the key and lands in object-literal context, where an injected computed property key [expr] is evaluated when zod.object({...}) runs -- which is at MODULE IMPORT (the export const X = zod.object({...}) executes on load) -> import-time RCE. The property name is a pure data field. Verified on orval 8.19.0 / Node. CWE-94 / CWE-95 / CWE-116.

Details

ts export const OpBody = zod.object({ "a":zod.string(),[require("fs").writeFileSync("PWNED","")]:zod.string(),"b": zod.string().optional() })

Sibling: the MSW mock uses a single-quoted key (' breakout, call-time) -- separate report. The TS interface key is a type (DoS only). Distinct from orval's $ref / route-path / server-url / zod-default findings.

PoC

reproduce.sh (+ makespec.py) attached: a property name a":zod.string(),[require("fs").writeFileSync("<marker>","")]:zod.string(),"b -> zod.object; evaluating it (= importing the module) writes the marker. Verified on 8.19.0.

Impact

JavaScript / OS command execution (via childprocess) at import time for anyone who generates an orval zod client from an attacker-controlled spec and imports it. Estimated Critical, e.g. CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N.

Suggested fix

Escape the property name for the JS string key (JSON.stringify) in the zod.object key generation; never interpolate a raw property name adjacent to [ ] in object-literal position. maintainer-report.txt makespec.py reproduce.sh

Affected Software

1 affected componentFixes available
npm/orval<8.21.0
8.21.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade npm/orval to a version that resolves this vulnerability.

    Fixed in 8.21.0
  2. Upgrade

    Upgrade orval to a version that resolves this vulnerability.

    Fixed in 8.19.0
  3. Configuration

    In the generated zod.object({...}) object-literal, escape the property name when emitting the JS string key so that embedded " characters can’t break out of the key context. Concretely: generate the key using JSON.stringify and never emit a raw property name adjacent to [ ] in object-literal position without escaping.

    orval zod client generator escaping of JSON string keys for zod.object property names = escape double quotes in property names when generating JavaScript object literal keys (e.g., use JSON.stringify for the JS string key)

Event History

Sep 2, 2026
Advisory Published
via GitHub·02:52 PM
Data Sourced
via GitHub·02:52 PM
DescriptionWeaknessAffected Software

Frequently Asked Questions

1

Who is exposed to this issue?

Users who generate and then import Orval Zod client code from an API specification containing attacker-controlled property names are exposed. The vulnerable property name is treated as data in the specification but is emitted into executable JavaScript object-literal syntax.

2

What must an attacker control to exploit it?

An attacker needs control over a schema property name in the API specification. By including a double quote and injected computed property expression, they can cause code to execute when the generated module is imported.

3

When does the injected code execute?

Execution occurs at module import time, because the generated zod.object({...}) expression runs as the exported schema is initialized. The proof of concept demonstrates file creation during import, and the impact includes JavaScript or OS command execution through child_process.

4

Is a known affected version identified?

The issue was verified on Orval 8.19.0 with Node. No fixed version is provided in the available data.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203