CVE-2026-96754 in orval
Summary
by MITRE • 09/23/2026
orval versions before 8.29.0 contain a code injection vulnerability in the @orval/hono generator that fails to escape OpenAPI path values in single-quoted route literals. Attackers can craft an OpenAPI document with an apostrophe in a static path segment to inject arbitrary JavaScript code that executes when the generated TypeScript module is imported.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/23/2026
The vulnerability identified in Orval versions prior to 8.29.0 represents a critical server-side code injection flaw within the @orval/hono generator component. This security issue stems from an insufficient sanitization of input data derived from OpenAPI specification documents, specifically targeting static path segments defined by users or third-party API definitions. When the Orval tool processes these specifications to generate TypeScript modules for Hono-based applications, it constructs route literals using single quotes without properly escaping special characters present in the original path values. This lack of proper string literal escaping creates a direct pathway for malicious actors to inject arbitrary JavaScript code into the generated source files.
The technical mechanism behind this vulnerability relies on the structure of how modern web frameworks like Hono handle routing definitions. The generator typically outputs route configurations as TypeScript modules where paths are defined within single-quoted strings. If an OpenAPI document contains a path segment with an unescaped apostrophe, such as /users/'admin', the resulting generated code will contain malformed syntax or, more dangerously, allow for string termination and subsequent command injection. For instance, if the generator produces a line like const route = '/users/' + userInput; without escaping the internal quote, it can break out of the intended context. In this specific case, because the output is TypeScript/JavaScript code that gets imported by the application, any injected payload becomes part of the executable module scope upon importation.
The operational impact of this vulnerability is severe due to its potential for Remote Code Execution (RCE). Since the generated modules are typically included in the main build process and executed during server startup or when specific routes are accessed, an attacker who can influence the OpenAPI specification used by the development pipeline can achieve arbitrary code execution on the host system. This could lead to full compromise of the backend infrastructure, including data exfiltration, modification of application logic, or use as a pivot point for further attacks within the internal network. The risk is particularly acute in automated CI/CD pipelines where OpenAPI documents might be fetched from external sources without rigorous validation before being processed by Orval.
This vulnerability aligns with CWE-94 Improper Control of Generation of Code (Code Injection), specifically involving server-side code generation, and maps to the ATT&CK technique T1059 Command and Scripting Interpreter for execution of injected payloads. The failure to escape input in a context where it is interpreted as executable code rather than data highlights a fundamental flaw in secure coding practices related to template or generator construction. It underscores the importance of treating all external inputs, even those embedded within configuration files like OpenAPI specs, as untrusted and requiring strict sanitization before inclusion in generated artifacts.
To mitigate this risk, organizations must immediately upgrade Orval to version 8.29.0 or later, where the @orval/hono generator has been patched to correctly escape special characters such as apostrophes within path segments. In environments where upgrading is not immediately feasible, developers should implement strict validation of OpenAPI documents prior to processing them with Orval. This includes sanitizing all path parameters and static route definitions to remove or escape single quotes and other potentially dangerous characters. Additionally, adopting a zero-trust approach for code generation tools by validating the integrity and source of API specifications can prevent malicious payloads from entering the development pipeline in the first place. Regular security audits of generated code artifacts are also recommended to detect any anomalies that might indicate successful exploitation attempts.