AIKIDO-2026-531712
orval is vulnerable to Code Injection
100
Critical Risk
This Affects:
orvalTL;DR
Orval inserts OpenAPI numeric and length constraint fields such as minimum, maxItems, and minLength directly into generated code as unvalidated expressions in the zod, effect, and faker generators. Under OpenAPI 3.1 specs these fields can arrive as strings, allowing a crafted constraint to inject arbitrary JavaScript at the interpolation points. The injected code runs at import time for schema modules or at test runtime for mocks. The fix validates every numeric constraint before interpolation.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you generate schemas or mocks from an untrusted or externally influenced OpenAPI document.
Background info
orval is vulnerable to Code Injection in versions 8.4.0 - 8.29.0.
How to fix this
Upgrade the orval library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.