GHSA-p4cg-3328-rvfg: Npm/orval vulnerability
Summary
Orval's zod schema generation emits the query-parameter default value as a module-level template literal (export const …Default = <default>;) without escaping ${ or the backtick. A default of the form v${<code>}w injects a live JavaScript expression evaluated when the generated zod schema module is imported, executing attacker-controlled code at import — no request or function call needed. Verified on Orval 8.19.0; survives default OpenAPI validation.
Details
ts export const …Default = v${globalThis.ORVPWN()}w; // ${...} = arbitrary JS expression, runs at import
Malicious input: a query parameter with a default of v${<attacker JS>}w. ${...} permits any JS expression.
Note: this is one of several default-bearing positions that reach the same unescaped zod template-literal sink; a single fix (escape default values) closes all of them, and a CNA may choose to consolidate the related reports.
PoC
reproduce.sh (+ makespec.py) attached: generates the zod schema with default validation, bundles it, imports it, and shows a marker written at import. Verified on 8.19.0.
Impact
Code execution at import in any application that imports a zod schema module generated from an attacker-controlled or attacker-influenced OpenAPI description.
Suggested fix
Emit default values via a proper string-literal encoder (JSON.stringify, or escape backtick and ${ if a template literal must be used); never interpolate a spec value into a template literal. Apply to every default position. maintainer-report.txt makespec.py reproduce.sh
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/orvalto a version that resolves this vulnerability.Fixed in 8.21.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications that generate and import Orval zod schema modules from OpenAPI specifications containing attacker-controlled parameter default values are exposed. The injected expression runs when the generated module is imported, without requiring an HTTP request or function call.
What does an attacker need to exploit it?
An attacker needs influence over an OpenAPI default value that reaches Orval's zod schema generation, such as a query-parameter default. A value shaped like v${<attacker JavaScript>}w can inject an arbitrary JavaScript expression.
Does OpenAPI default validation prevent exploitation?
No. The issue was verified with default OpenAPI validation enabled, and the malicious default value survives that validation.
How can I determine whether generated output is affected?
Inspect generated zod schema modules for module-level constants that embed default values in JavaScript template literals. Generated defaults containing unescaped ${ or backticks can cause code to execute when the module is imported.
What can be done before a fix is available?
Do not generate or import zod schema modules from untrusted OpenAPI specifications containing default values. Escaping default values before they are emitted into template literals addresses the described sink.