CVE-2026-71867 in Orval
Summary
by MITRE • 08/19/2026
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a single quote in a schema property name is emitted into single-quoted object keys in generated MSW mock factories without safe encoding. This permits attacker-controlled JavaScript to be evaluated when the generated mock factory is called by tests or an MSW handler, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/core/src/getters/keys.ts function getKey and MSW mock generation. This issue is fixed in version 8.21.0.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/19/2026
The vulnerability identified involves a critical input validation failure within Orval, an open-source tool designed to generate type-safe JavaScript clients from OpenAPI v3 and Swagger v2 specifications. Specifically, the flaw resides in the MSW mock generation logic, which is utilized by developers to simulate API responses during testing or development phases. The core issue occurs when processing schema property names that contain single quote characters. In versions prior to 8.21.0, the function responsible for generating object keys fails to properly sanitize or encode these special characters before embedding them into JavaScript code structures. This lack of sanitization allows raw user-controlled input from the API specification to be directly injected into the generated source files without escaping mechanisms that would prevent interpretation as executable code.
From a technical perspective, this flaw constitutes an injection vulnerability where untrusted data is treated as part of a command or query structure. When Orval generates mock factories for MSW (Mock Service Worker), it creates JavaScript objects using single quotes to delimit property names. If a schema defines a property name containing a single quote, such as user's profile, the generator outputs this directly into the code string without escaping the internal quote. This results in malformed or syntactically valid but semantically dangerous JavaScript object literals that can alter control flow when executed. The impact is particularly severe because MSW handlers are often integrated into CI/CD pipelines and local development environments to simulate backend behavior, meaning any malicious payload embedded via a compromised API specification could be automatically evaluated by testing frameworks or developer machines during routine operations.
The operational impact of this vulnerability extends beyond simple syntax errors; it enables arbitrary code execution within the context where the generated mocks are run. An attacker who controls the OpenAPI specification used to generate these clients can inject malicious JavaScript payloads that execute when tests are executed or when developers import and use the mocked services. This compromises the integrity of the development environment, potentially leading to credential theft, data exfiltration, or further lateral movement within CI/CD systems if those pipelines automatically process untrusted API definitions. The vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation known as Cross-site Scripting (XSS), although in this context it manifests more broadly as code injection rather than just browser-based XSS due to the Node.js execution environment typical for MSW and testing frameworks.
Mitigation strategies primarily involve upgrading Orval to version 8.21.0 or later, where the developers have implemented proper encoding of special characters within schema property names during key generation. For organizations unable to immediately upgrade, it is crucial to enforce strict validation on all OpenAPI specifications before they are processed by code generators. This includes sanitizing input data to remove or escape single quotes and other control characters that could interfere with JavaScript syntax. Additionally, developers should avoid importing generated mock files from untrusted sources into their local environments or CI pipelines without first auditing the content for suspicious patterns. Implementing static analysis tools capable of detecting injection vulnerabilities in dynamically generated code can also provide an additional layer of defense against such supply chain attacks targeting development toolchains.