CVE-2026-96756 in orval
Summary
by MITRE • 09/23/2026
orval versions before 8.30.0 contain a code injection vulnerability in the @orval/core factory generator that fails to escape date default values in new Date() calls. Attackers can inject arbitrary expressions through apostrophes in OpenAPI schema defaults to execute code with the privileges of the consumer process when factoryMethods and useDates options are enabled.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/23/2026
The vulnerability identified in Orval versions prior to 8.30.0 represents a critical server-side code injection flaw within the @orval/core package, specifically affecting its factory generator component. This security issue arises from an improper neutralization of special elements during input processing, where date default values defined in OpenAPI schemas are not adequately sanitized before being embedded into JavaScript expressions. When developers enable both the factoryMethods and useDates configuration options, Orval generates code that utilizes new Date() constructors to handle these defaults. The core technical flaw lies in the failure to escape single quotes or apostrophes present within the schema's default value strings. Because the generated code directly interpolates these unescaped values into date parsing logic, an attacker who controls the OpenAPI specification can inject arbitrary JavaScript expressions by embedding them within string literals using apostrophe delimiters.
From a technical perspective, this vulnerability is classified under CWE-94 as Improper Control of Generation of Code (Code Injection). The attack vector relies on the consumer process executing the generated code without sufficient validation or sandboxing. When an OpenAPI schema contains a default value such as '2023-01-01' followed by malicious JavaScript payload enclosed in apostrophes, the resulting generated TypeScript or JavaScript file will contain syntactically valid but semantically dangerous code. For instance, if the generator fails to escape the quote, it might produce something akin to new Date('malicious_payload'); which could lead to remote code execution depending on how the date string is processed and what side effects are triggered by the injected expression. This exploitation path requires that the victim application uses Orval in a build-time or development-time context where the generated files are subsequently executed, thereby granting the attacker the ability to run commands with the privileges of the user account running the Node.js process.
The operational impact of this vulnerability is severe, particularly for organizations relying on automated API client generation as part of their continuous integration and deployment pipelines. If an OpenAPI specification is sourced from a third-party provider or if internal specifications are not strictly audited for malicious content, attackers can compromise the build environment. This could lead to data exfiltration, installation of backdoors, or lateral movement within the network infrastructure hosting the development servers. The risk is amplified because many developers treat generated code as trusted boilerplate and do not review it manually before committing or deploying. Consequently, a single malicious default value in an API definition can result in widespread compromise across all systems that consume this specific version of Orval with the specified configuration flags enabled.
Mitigation strategies primarily involve upgrading to Orval version 8.30.0 or later, where the factory generator has been patched to properly escape special characters within date defaults before embedding them into code structures. For environments unable to upgrade immediately, developers should implement strict input validation on OpenAPI schemas received from external sources and avoid using the useDates option with untrusted API definitions. Additionally, adopting a principle of least privilege for build processes can limit the damage if an injection attempt succeeds by restricting the permissions of the Node.js process executing the generated code. Security teams should also consider integrating static analysis tools that flag potential code injection patterns in auto-generated files as part of their software supply chain security posture. This incident underscores the importance of treating all inputs to code generation tools with the same rigor applied to runtime application inputs, ensuring that schema definitions are validated against known safe patterns before being processed by generators like Orval.