Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
12 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Orval emits the OpenAPI path into the generated request URL as a TEMPLATE LITERAL ( /users/... ) without escaping the backtick character. A path containing a backtick closes the template literal and injects a concatenation expression that is evaluated when the generated URL/request/key function is called, executing attacker-controlled code. Affects the axios, fetch, react-query, and swr clients. Verified on Orval 8.19.0; survives Orval's default OpenAPI validation. Details The backtick in the path terminates the ... literal; + (<code) + runs as a live expression; a trailing backtick reopens a template literal so the file stays valid. The code runs whenever the generated request function, URL builder, or query-key function is called. This is distinct from Orval's four published CVEs: CVE-2026-22785 (summary - MCP server), CVE-2026-23947 / CVE-2026-25141 (x-enumDescriptions), and CVE-2026-24132 (const - mock files). This is a different field (the route path) and a different…
Recommended action: Upgrade to 8.21.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
When Orval is configured with output.baseUrl.getBaseUrlFromSpecification: true, it bakes the spec's servers[0].url into the generated request URL as a template literal without escaping the backtick. A server URL containing a backtick closes the template literal and injects a concatenation expression evaluated when the generated URL/request function is called, executing attacker-controlled code. Verified on Orval 8.19.0 (fetch client); survives default OpenAPI validation. Details Prerequisite: the documented getBaseUrlFromSpecification: true option (takes the base URL from the OpenAPI servers block). This is the same output sink as the route-path case (request-URL template literal) reached via the server url field. Distinct from Orval's published CVEs (CVE-2026-22785 summary/MCP, CVE-2026-23947 / CVE-2026-25141 x-enumDescriptions, CVE-2026-24132 const/mock). PoC reproduce.sh (+ makespec.py) attached: generates a fetch client with getBaseUrlFromSpecification: true, bundles it,…
Recommended action: Upgrade to 8.21.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Orval's zod schema generation emits a schema's default value as a module-level template literal (export const …Default = <default;) without escaping ${ or the backtick. A default of the form v${<code}w injects a live JavaScript expression that is evaluated when the generated zod schema module is imported, executing attacker-controlled code at import — no request or function call needed. Verified on Orval 8.19.0; survives default OpenAPI validation. Details ${...} permits an arbitrary JS expression. Orval escapes its other value sinks (enum, mock, regex, object-default values) with \' inside single-quoted strings; the string default is the one value emitted as a backtick template literal, so ${...}/backtick are interpreted, not escaped. Distinct from the URL-template-literal cases (different field and sink) and from the published Orval CVEs (summary/MCP, x-enumDescriptions, const/mock). PoC reproduce.sh (+ makespec.py) attached: generates the zod schema with default…
Recommended action: Upgrade to 8.21.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Orval's zod schema generation emits the array-items default value as a module-level template literal (export const …Default = <default;) without escaping ${ or the backtick. A default of the form v${<code}w injects a live JavaScript expression evaluated when the generated zod schema module is imported, executing attacker-controlled code at import — no request or function call needed. Verified on Orval 8.19.0; survives default OpenAPI validation. Details Malicious input: an array property (string items) with a default of v${<attacker JS}w. ${...} permits any JS expression. Note: this is one of several default-bearing positions that reach the same unescaped zod template-literal sink; a single fix (escape default values) closes all of them, and a CNA may choose to consolidate the related reports. PoC reproduce.sh (+ makespec.py) attached: generates the zod schema with default validation, bundles it, imports it, and shows a marker written at import. Verified on 8.19.0. Impact…
Recommended action: Upgrade to 8.21.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Orval's zod schema generation emits the header-parameter default value as a module-level template literal (export const Default = <default;) without escaping ${ or the backtick. A default of the form v${<code}w injects a live JavaScript expression evaluated when the generated zod schema module is imported, executing attacker-controlled code at import — no request or function call needed. Verified on Orval 8.19.0; survives default OpenAPI validation. Details Malicious input: a header parameter with a default of v${<attacker JS}w. ${...} permits any JS expression. Note: this is one of several default-bearing positions that reach the same unescaped zod template-literal sink; a single fix (escape default values) closes all of them, and a CNA may choose to consolidate the related reports. PoC reproduce.sh (+ makespec.py) attached: generates the zod schema with default validation, bundles it, imports it, and shows a marker written at import. Verified on 8.19.0. Impact Code…
Recommended action: Upgrade to 8.21.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
orval, when generating MSW mocks (output.mock: true), emits each schema property name as a single-quoted object key in the mock factory WITHOUT escaping the single quote. A ' in a property name closes the key and lands in object-literal context, where an injected computed property key [expr] is evaluated when the mock factory is called (e.g. in tests / MSW handlers) - RCE. The property name is a pure data field. Verified on orval 8.19.0 / Node. Details Safe elsewhere: the zod schema double-quotes the property name; the TS interface key is a type (DoS only). Distinct from orval's $ref / route-path / server-url / zod-default findings. PoC reproduce.sh (+ makespec.py) attached: a property name x': 0, [require("fs").writeFileSync("<marker","")]: 0, 'y - mock object literal; calling the mock factory writes the marker. Verified on 8.19.0. Impact JavaScript / OS command execution (via childprocess) on the machine of anyone who generates orval mocks from an attacker controlled spec…
Recommended action: Upgrade to 8.21.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Orval's zod schema generation emits the enum-typed default value as a module-level template literal (export const …Default = <default;) without escaping ${ or the backtick. A default of the form v${<code}w injects a live JavaScript expression evaluated when the generated zod schema module is imported, executing attacker-controlled code at import — no request or function call needed. Verified on Orval 8.19.0; survives default OpenAPI validation. Details Malicious input: an enum-typed property with a default of v${<attacker JS}w. ${...} permits any JS expression. Note: this is one of several default-bearing positions that reach the same unescaped zod template-literal sink; a single fix (escape default values) closes all of them, and a CNA may choose to consolidate the related reports. PoC reproduce.sh (+ makespec.py) attached: generates the zod schema with default validation, bundles it, imports it, and shows a marker written at import. Verified on 8.19.0. Impact Code execution…
Recommended action: Upgrade to 8.21.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
orval's zod client emits each query parameter name as a double-quoted key in the generated zod.object({...}) request-validation schema WITHOUT escaping the double quote. A " in the query parameter name closes the key and lands in object-literal context, where an injected computed property key [expr] is evaluated when zod.object({...}) runs -- at MODULE IMPORT (export const OpQueryParams = zod.object({...}) executes on load) - import-time RCE. The query parameter name is a pure data field. Verified on orval 8.19.0 / Node. Details export const OpQueryParams = zod.object({ "a":zod.string(),[require("fs").writeFileSync("PWNED","")]:zod.string(),"b": ... }) Also affects the hono client (reuses zod generation). orval escapes values in zod arrays but not keys in zod.object. Sibling fields: schema property name, header parameter name (CVE-97) (separate reports). Distinct from orval's $ref / route-path / server-url / zod-default findings. PoC reproduce.sh (+ makespec.py) attached: a…
Recommended action: Upgrade to 8.21.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
orval's zod client emits each header parameter name as a double-quoted key in the generated zod.object({...}) request-validation schema WITHOUT escaping the double quote. A " in the header parameter name closes the key and lands in object-literal context, where an injected computed property key [expr] is evaluated when zod.object({...}) runs -- at MODULE IMPORT (export const OpHeader = zod.object({...}) executes on load) - import-time RCE. The header parameter name is a pure data field. Verified on orval 8.19.0 / Node. Details export const OpHeader = zod.object({ "a":zod.string(),[require("fs").writeFileSync("PWNED","")]:zod.string(),"b": ... }) Also affects the hono client (reuses zod generation). orval escapes values in zod arrays but not keys in zod.object. Sibling fields: schema property name, query parameter name (CVE-96) (separate reports). Distinct from orval's $ref / route-path / server-url / zod-default findings. PoC reproduce.sh (+ makespec.py) attached: a header…
Recommended action: Upgrade to 8.21.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Orval resolves OpenAPI $refs by fetching remote http(s) URLs and reading local files (including absolute / out-of-tree paths), inlining the referenced schema into the generated client. Running orval on a spec whose $ref points at an attacker/internal URL or an arbitrary local file yields SSRF, remote file inclusion, and local file inclusion. Verified on 8.19.0. This is a different class from Orval's published output-injection CVEs (CVE-2026-22785/23947/24132/25141), none of which covers the $ref resolver. Details - $ref: http://attacker/internal-evil.json#/... → build host fetches (SSRF) and inlines the remote schema (RFI); confirmed property REMOTEORVALPROP in the generated client. - $ref: /abs/path.json#/... or ../../secret.json#/... → out-of-tree local file read + inlined (LFI). No RCE: on 8.19.0 the description JSDoc is escaped (/-\/, the published fix), so $ref content cannot break out into code. The chain stops at SSRF + RFI + LFI. Fix: don't resolve remote $refs by…
Recommended action: Upgrade to 8.22.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Orval's zod schema generation emits the query-parameter default value as a module-level template literal (export const …Default = <default;) without escaping ${ or the backtick. A default of the form v${<code}w injects a live JavaScript expression evaluated when the generated zod schema module is imported, executing attacker-controlled code at import — no request or function call needed. Verified on Orval 8.19.0; survives default OpenAPI validation. Details Malicious input: a query parameter with a default of v${<attacker JS}w. ${...} permits any JS expression. Note: this is one of several default-bearing positions that reach the same unescaped zod template-literal sink; a single fix (escape default values) closes all of them, and a CNA may choose to consolidate the related reports. PoC reproduce.sh (+ makespec.py) attached: generates the zod schema with default validation, bundles it, imports it, and shows a marker written at import. Verified on 8.19.0. Impact Code execution…
Recommended action: Upgrade to 8.21.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
orval's zod client emits each schema property name as a double-quoted key in the generated zod.object({...}) WITHOUT escaping the double quote. A " in a property name closes the key and lands in object-literal context, where an injected computed property key [expr] is evaluated when zod.object({...}) runs -- which is at MODULE IMPORT (the export const X = zod.object({...}) executes on load) - import-time RCE. The property name is a pure data field. Verified on orval 8.19.0 / Node. CWE-94 / CWE-95 / CWE-116. Details Sibling: the MSW mock uses a single-quoted key (' breakout, call-time) -- separate report. The TS interface key is a type (DoS only). Distinct from orval's $ref / route-path / server-url / zod-default findings. PoC reproduce.sh (+ makespec.py) attached: a property name a":zod.string(),[require("fs").writeFileSync("<marker","")]:zod.string(),"b - zod.object; evaluating it (= importing the module) writes the marker. Verified on 8.19.0. Impact JavaScript / OS command…
Recommended action: Upgrade to 8.21.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.