AIKIDO-2026-929342
@orval/core is vulnerable to Code Injection
98
Critical Risk
This Affects:
@orval/coreTL;DR
The @orval/core form-data serializer interpolates untrusted OpenAPI values into generated request code without escaping, both as backtick-delimited FormData keys and as a single-quoted type field derived from contentMediaType and encoding content types. A crafted property name or content type breaks out of the literal and injects arbitrary JavaScript into the generated serializer. The code executes whenever the generated multipart or url-encoded request function runs. The fix escapes property keys and content-type strings before emitting them.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you generate request code from an untrusted or externally influenced OpenAPI document that defines a form-data request body.
Background info
@orval/core is vulnerable to Code Injection in versions 8.0.0 - 8.28.1.
How to fix this
Upgrade the @orval/core and/or the orval library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.