CVE-2026-96755 in orval
Summary
by MITRE • 09/23/2026
orval versions 8.14.0 through 8.28.1 contain a code injection vulnerability in the @orval/effect generator that converts OpenAPI schema defaults into template literals. Attackers can inject arbitrary JavaScript expressions via schema defaults containing ${...} syntax, which are executed at module scope when the generated code is built or imported.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/23/2026
The identified security flaw resides within the Orval library, specifically affecting versions 8.14.0 through 8.28.1 in its @orval/effect generator component. This vulnerability stems from an insecure handling of OpenAPI schema defaults during code generation processes. The core technical issue is a server-side template injection or code injection flaw where the tool fails to properly sanitize input data before embedding it into generated JavaScript files. When developers utilize Orval to generate client-side API clients based on OpenAPI specifications, the generator attempts to convert default values defined in the schema directly into template literals within the resulting source code. This architectural decision creates a critical attack vector if the underlying specification contains maliciously crafted content.
The operational mechanism of this vulnerability relies on the specific syntax used for JavaScript template strings. If an attacker controls or influences the OpenAPI schema, they can inject arbitrary JavaScript expressions by embedding the ${...} interpolation syntax within string default values. Because Orval naively processes these defaults without escaping or validating their contents, the injected code is written directly into the generated module files. When a developer builds the project or imports the generated client library, the Node.js runtime or browser environment executes this embedded JavaScript at the module scope. This execution occurs before any application logic runs, granting the attacker immediate and unrestricted access to the runtime context of the consuming application.
The impact of this vulnerability is severe due to its potential for remote code execution in development environments and potentially production systems if generated code is deployed without review. An adversary could exploit this flaw to exfiltrate sensitive data such as environment variables, session tokens, or database credentials stored within the module scope. Furthermore, the attacker could modify application behavior by injecting logic that alters API calls, redirects users, or establishes persistent backdoors. This type of attack falls under the category of injection vulnerabilities where untrusted input is interpreted as executable code rather than data. It represents a significant risk to software supply chain integrity because developers often trust generated code implicitly, assuming it is safe based on the tool's reputation and automated nature.
From an industry standards perspective, this vulnerability aligns with CWE-94 Improper Control of Generation of Code (Code Injection). The failure lies in the application's inability to distinguish between data intended for display or storage and code intended for execution. Additionally, from a tactical standpoint within the MITRE ATT&CK framework, this exploit relates to techniques involving command and script interpretation, specifically how malicious scripts can be executed through legitimate software components. It also touches upon supply chain compromise vectors where trusted tools are leveraged to introduce malware into downstream applications. The vulnerability highlights the dangers of auto-generating code from external specifications without rigorous input validation and sanitization layers.
Mitigation strategies must focus on both immediate remediation and long-term defensive coding practices. Users running affected versions should immediately upgrade Orval to a patched version that addresses this specific injection flaw in the @orval/effect generator. Until an update is available, developers can implement manual safeguards by validating OpenAPI schemas before processing them with Orval. This involves sanitizing any string fields designated as defaults to ensure they do not contain template literal interpolation syntax or other executable code patterns. Additionally, integrating static analysis tools into the CI/CD pipeline that detect suspicious JavaScript constructs in generated files can provide an additional layer of defense. Organizations should also enforce strict review processes for auto-generated code, treating it with the same scrutiny applied to manually written source code to catch any anomalies introduced by compromised specifications or tooling bugs.