GHSA-w727-8j6c-2rj4: Code Injection
Summary
Orval's zod schema generation emits a schema's default value as a module-level template literal (export const …Default = <default>;) without escaping ${ or the backtick. A default of the form v${<code>}w injects a live JavaScript expression that is evaluated when the generated zod schema module is imported, executing attacker-controlled code at import — no request or function call needed. Verified on Orval 8.19.0; survives default OpenAPI validation.
Details
ts export const getIResponseDsDefault = v${globalThis.ORVPWN()}w;
${...} permits an arbitrary JS expression. Orval escapes its other value sinks (enum, mock, regex, object-default values) with \' inside single-quoted strings; the string default is the one value emitted as a backtick template literal, so ${...}/backtick are interpreted, not escaped. Distinct from the URL-template-literal cases (different field and sink) and from the published Orval CVEs (summary/MCP, x-enumDescriptions, const/mock).
PoC
reproduce.sh (+ makespec.py) attached: generates the zod schema with default validation, bundles it, imports it, and shows a marker written at import. Verified on 8.19.0.
Impact
Code execution at import in any application that imports a zod schema module generated from an attacker-controlled or attacker-influenced OpenAPI description.
Suggested fix
Emit default values via a proper string-literal encoder (JSON.stringify, or escape backtick and ${ if a template literal must be used); never interpolate a spec value into a template literal.
maintainer-report.txt makespec.py reproduce.sh
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/orvalto a version that resolves this vulnerability.Fixed in 8.21.0 - Upgrade
Upgrade
Orvalto a version that resolves this vulnerability.Fixed in 8.19.0 - Configuration
When generating Zod schema module exports like `export const <X>Default = `<default>`;`, emit the schema `default` using a proper string-literal encoder (e.g., JSON.stringify). Never interpolate attacker-influenced spec values into a template literal; if template literals must be used, escape backticks and the `${` sequence so `${...}` cannot be interpreted as a live JS expression.
Orval zod schema generator default value emission = Use proper string-literal encoding (e.g., JSON.stringify) instead of module-level template literals that allow `${...}` evaluation - Compensating control
Treat any OpenAPI description that can be attacker-controlled or attacker-influenced as untrusted input; avoid importing/generated schema modules derived from such specs in applications where import-time code execution would be unacceptable.
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
An attacker needs control over a string default value in an OpenAPI input processed by Orval's zod schema generation. A default containing `${...}` or a backtick can cause attacker-controlled JavaScript to be emitted into the generated module.
When does the injected code run?
The injected expression runs when the generated zod schema module is imported. No HTTP request, schema validation call, or other function invocation is required after import.
Can normal OpenAPI validation prevent the malicious default?
No. The issue was verified with default OpenAPI validation, and the malicious default format described is accepted through that validation.
How can teams check whether generated output is affected?
Inspect generated zod schema modules for exported `…Default` values emitted as backtick template literals. Look specifically for unescaped `${` sequences or backticks originating from OpenAPI string default values.
What can be done if updating is not immediately possible?
Do not generate or import zod schema output from untrusted OpenAPI specifications or unreviewed changes to string default values. Review generated modules before importing them and reject defaults containing `${` or backticks.