Advisories for Npm/Orval package

2026

Orval: RCE via servers[].url -> unescaped request-URL template literal (with getBaseUrlFromSpecification)

When Orval is configured with output.baseUrl.getBaseUrlFromSpecification: true, it bakes the spec's servers[0].url into the generated request URL as a template literal without escaping the backtick. A server URL containing a backtick closes the template literal and injects a concatenation expression evaluated when the generated URL/request function is called, executing attacker-controlled code. Verified on Orval 8.19.0 (fetch client); survives default OpenAPI validation.

Orval: RCE via schema property name -> computed-property-key injection in the MSW mock generator

orval, when generating MSW mocks (output.mock: true), emits each schema property name as a single-quoted object key in the mock factory WITHOUT escaping the single quote. A ' in a property name closes the key and lands in object-literal context, where an injected computed property key [expr] is evaluated when the mock factory is called (e.g. in tests / MSW handlers) -> RCE. The property name is a pure data …

Orval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout)

Orval emits the OpenAPI path into the generated request URL as a TEMPLATE LITERAL (/users/...) without escaping the backtick character. A path containing a backtick closes the template literal and injects a concatenation expression that is evaluated when the generated URL/request/key function is called, executing attacker-controlled code. Affects the axios, fetch, react-query, and swr clients. Verified on Orval 8.19.0; survives Orval's default OpenAPI validation.

Orval: Import-time RCE via schema default -> zod module-level template literal

Orval's zod schema generation emits a schema's default value as a module-level template literal (export const …Default = ;) without escaping ${ or the backtick. A default of the form v${<code>}w injects a live JavaScript expression that is evaluated when the generated zod schema module is imported, executing attacker-controlled code at import — no request or function call needed. Verified on Orval 8.19.0; survives default OpenAPI validation.

Orval: Import-time RCE via query parameter name -> computed-property-key injection in the zod cli

orval's zod client emits each query parameter name as a double-quoted key in the generated zod.object({…}) request-validation schema WITHOUT escaping the double quote. A " in the query parameter name closes the key and lands in object-literal context, where an injected computed property key [expr] is evaluated when zod.object({…}) runs – at MODULE IMPORT (export const OpQueryParams = zod.object({…}) executes on load) -> import-time RCE. The query parameter name is …

Orval: Import-time RCE via header-parameter default -> zod module-level template literal

Orval's zod schema generation emits the header-parameter default value as a module-level template literal (export const Default = ;) without escaping ${ or the backtick. A default of the form v${<code>}w injects a live JavaScript expression evaluated when the generated zod schema module is imported, executing attacker-controlled code at import — no request or function call needed. Verified on Orval 8.19.0; survives default OpenAPI validation.

Orval: Import-time RCE via header parameter name -> computed-property-key injection in the zod client

orval's zod client emits each header parameter name as a double-quoted key in the generated zod.object({…}) request-validation schema WITHOUT escaping the double quote. A " in the header parameter name closes the key and lands in object-literal context, where an injected computed property key [expr] is evaluated when zod.object({…}) runs – at MODULE IMPORT (export const OpHeader = zod.object({…}) executes on load) -> import-time RCE. The header parameter name is …

Orval: Import-time RCE via enum-typed default -> zod module-level template literal

Orval's zod schema generation emits the enum-typed default value as a module-level template literal (export const …Default = ;) without escaping ${ or the backtick. A default of the form v${<code>}w injects a live JavaScript expression evaluated when the generated zod schema module is imported, executing attacker-controlled code at import — no request or function call needed. Verified on Orval 8.19.0; survives default OpenAPI validation.

Orval: Import-time RCE via array-items default -> zod module-level template literal

Orval's zod schema generation emits the array-items default value as a module-level template literal (export const …Default = ;) without escaping ${ or the backtick. A default of the form v${<code>}w injects a live JavaScript expression evaluated when the generated zod schema module is imported, executing attacker-controlled code at import — no request or function call needed. Verified on Orval 8.19.0; survives default OpenAPI validation.

Orval: Import-time RCE via schema property name -> computed-property-key injection in the zod client

orval's zod client emits each schema property name as a double-quoted key in the generated zod.object({…}) WITHOUT escaping the double quote. A " in a property name closes the key and lands in object-literal context, where an injected computed property key [expr] is evaluated when zod.object({…}) runs – which is at MODULE IMPORT (the export const X = zod.object({…}) executes on load) -> import-time RCE. The property name is a …

Orval: Import-time RCE via query-parameter default -> zod module-level template literal

Orval's zod schema generation emits the query-parameter default value as a module-level template literal (export const …Default = ;) without escaping ${ or the backtick. A default of the form v${<code>}w injects a live JavaScript expression evaluated when the generated zod schema module is imported, executing attacker-controlled code at import — no request or function call needed. Verified on Orval 8.19.0; survives default OpenAPI validation.

Orval: Generation-time SSRF + remote/local file inclusion via unrestricted $ref

Orval resolves OpenAPI $refs by fetching remote http(s) URLs and reading local files (including absolute / out-of-tree paths), inlining the referenced schema into the generated client. Running orval on a spec whose $ref points at an attacker/internal URL or an arbitrary local file yields SSRF, remote file inclusion, and local file inclusion. Verified on 8.19.0. This is a different class from Orval's published output-injection CVEs (CVE-2026-22785/23947/24132/25141), none of which covers …