GHSA-8j6p-r8jg-mxqh: Code Injection
Summary
Orval's zod schema generation emits the header-parameter default value as a module-level template literal (export const Default = <default>;) without escaping ${ or the backtick. A default of the form v${<code>}w injects a live JavaScript expression evaluated when the generated zod schema module is imported, executing attacker-controlled code at import — no request or function call needed. Verified on Orval 8.19.0; survives default OpenAPI validation.
Details
ts export const …Default = v${globalThis.ORVPWN()}w; // ${...} = arbitrary JS expression, runs at import
Malicious input: a header parameter with a default of v${<attacker JS>}w. ${...} permits any JS expression.
Note: this is one of several default-bearing positions that reach the same unescaped zod template-literal sink; a single fix (escape default values) closes all of them, and a CNA may choose to consolidate the related reports.
PoC
reproduce.sh (+ makespec.py) attached: generates the zod schema with default validation, bundles it, imports it, and shows a marker written at import. Verified on 8.19.0.
Impact
Code execution at import in any application that imports a zod schema module generated from an attacker-controlled or attacker-influenced OpenAPI description.
Suggested fix
Emit default values via a proper string-literal encoder (JSON.stringify, or escape backtick and ${ if a template literal must be used); never interpolate a spec value into a template literal. Apply to every default position. makespec.py reproduce.sh
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/orvalto a version that resolves this vulnerability.Fixed in 8.21.0 - Upgrade
Upgrade
Orval zod schema generationto a version that resolves this vulnerability.Fixed in 8.19.0Patch Orval 8.19.0 - Configuration
In the generated zod schema module, for every `default` position (including header-parameter defaults), emit the `default` value as a proper string literal so `${` is not interpreted as a JavaScript expression at module import. Specifically: escape backticks and the `${` sequence in code like `export const <X>Default = `<default>`;` to prevent `${...}` evaluation during import.
Orval zod schema generator module-level handling of OpenAPI `default` values in generated zod schema = Escape `${` sequences and backticks so defaults are emitted as safe string literals (e.g., use JSON.stringify; if using template literals, escape backtick and `${`).
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications are exposed if they generate and import Orval zod schema modules from an OpenAPI specification containing attacker-controlled default values. Header parameter defaults are confirmed to reach the vulnerable sink, and other default-bearing positions may also be affected.
What does an attacker need to trigger code execution?
An attacker needs to control a default value in the OpenAPI input so it contains a JavaScript template interpolation such as v${<attacker JS>}w. The generated schema must then be imported; no HTTP request or function call is required.
Does OpenAPI default validation prevent exploitation?
No. The issue was verified with default OpenAPI validation enabled, and the malicious default survives that validation.
How can teams check whether generated output is affected?
Inspect generated zod schema modules for default constants emitted as template literals and identify default values containing ${ or a backtick. Importing a generated module with an unescaped interpolation can evaluate the embedded expression during module import.
What can be done before a fix is applied?
Do not generate or import schemas from untrusted OpenAPI specifications containing defaults. Ensure default values are escaped before they are emitted into JavaScript template literals; escaping defaults closes the described sink.