CVE-2026-96757 in orval
Summary
by MITRE • 09/23/2026
orval before 8.29.0 fails to escape OpenAPI media-type keys when emitting them into single-quoted Content-Type string literals in generated code. Attackers can inject JavaScript through crafted media-type keys in OpenAPI specifications that executes when generated fetch operations or mock resolvers are invoked.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/23/2026
The vulnerability identified in Orval versions prior to 8.29.0 represents a significant security flaw within the code generation pipeline, specifically affecting how HTTP content types are handled during the emission of client-side JavaScript or TypeScript code. As an API-first development tool, Orval parses OpenAPI specifications and generates corresponding fetch functions, mock resolvers, and type definitions for frontend applications. The core technical failure lies in the sanitization logic applied to media-type keys extracted from these specifications. When generating a Content-Type header value, the library incorrectly embeds raw user-supplied strings into single-quoted JavaScript string literals without performing adequate escaping or validation of special characters. This oversight creates a classic injection vector where malicious input within the OpenAPI definition can break out of the intended string context and execute arbitrary code in the client environment.
From an operational perspective, this vulnerability allows for Stored Cross-Site Scripting if the generated code is deployed to production environments that consume untrusted or poorly vetted API specifications. An attacker who controls the OpenAPI specification file used by a development team can inject JavaScript payloads directly into the media-type fields of request bodies or response headers. When developers run Orval to generate their client libraries, these malicious strings are written verbatim into the source code files. Consequently, any application utilizing this generated library will execute the injected script whenever it performs an HTTP operation that triggers the affected Content-Type header construction. This is particularly dangerous in modern frontend architectures where such generated clients are bundled and executed within user browsers, potentially leading to session hijacking, credential theft, or defacement of the web interface through DOM manipulation.
The technical root cause aligns with CWE-79, which classifies improper neutralization of input during web page generation as Cross-site Scripting. The flaw is not in a runtime server component but rather in the static code generator itself, making it a supply chain risk vector. By injecting payload into the specification file, an attacker effectively compromises the integrity of the generated source code before it even reaches the build process. This type of vulnerability falls under the ATT&CK technique T1059, Command and Scripting Interpreter, as it enables the execution of arbitrary scripts within the client-side runtime environment via a trusted application component. The severity is amplified because developers often trust OpenAPI specifications implicitly, assuming they are safe data contracts rather than potential code injection points.
Mitigation strategies must focus on both immediate patching and long-term defensive coding practices. Organizations using Orval should immediately upgrade to version 8.29.0 or later, where the issue has been resolved by implementing proper escaping mechanisms for media-type keys before they are embedded into string literals. For environments that cannot update instantly, it is critical to enforce strict validation on all OpenAPI specification files within the CI/CD pipeline. Input sanitization routines should be applied to strip or escape special characters such as single quotes, double quotes, backslashes, and semicolons from media-type fields before they are processed by Orval. Additionally, developers should consider implementing Content Security Policy headers in their applications to mitigate the impact of any successful script injection attempts, although this is a compensating control rather than a fix for the underlying generation flaw. Regular auditing of third-party code generators and specification files remains essential to prevent similar supply chain attacks.