AIKIDO-2026-939997
orval is vulnerable to Code Injection
93
Critical Risk
This Affects:
orvalTL;DR
Orval interpolates OpenAPI media-type keys and encoding contentType values into single-quoted JavaScript string literals without sanitization across several generators. A media-type key containing a single quote closes the literal and injects arbitrary object-literal expressions into the generated client and mock code. The injected code executes when the generated HTTP client or mock handlers are invoked, and malicious specs still pass the default parser validation. The fix escapes all spec-controlled strings at each sink and adds grammar validation.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you generate client or mock code from an untrusted or externally influenced OpenAPI document.
Background info
orval is vulnerable to Code Injection in versions 6.7.1 - 8.28.1.
How to fix this
Upgrade the orval library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.