Summary
A code injection vulnerability in Orval's Hono generator fails to escape OpenAPI path values placed inside single-quoted route literals. An attacker who can supply or influence an OpenAPI document may cause arbitrary JavaScript to execute when the generated TypeScript module is imported.
Affected context
This issue occurs when the Orval Hono generator processes OpenAPI documents containing static path segments with apostrophes and emits those values directly into generated route code. Risk depends on whether an attacker can provide or modify the OpenAPI specification and whether the resulting module is later imported or executed in a privileged development, build, or application environment.
Exploit preconditions
- Attack surface: OpenAPI document processing by the Orval Hono code generator
- Required access: Ability to supply or modify an OpenAPI document consumed by the generator
- Trigger point: Import or execution of the generated TypeScript module
- Why exploitation is possible: An unescaped apostrophe in a static path segment can break out of a single-quoted route literal and introduce JavaScript syntax into generated source code
Why this happens
The vulnerability results from embedding OpenAPI-controlled path values into JavaScript or TypeScript source without applying context-aware escaping or using a structured code-generation mechanism. A crafted value can alter the intended string literal and become executable code when the generated module is loaded. This maps to CWE-94: Improper Control of Generation of Code, because externally influenced data is incorporated into generated program code without adequately preserving its data-only interpretation.
Potential impact
- Arbitrary JavaScript execution in the environment that imports the generated module
- Compromise of build or development systems processing the malicious specification
- Exposure or alteration of source code, credentials, or other accessible files
- Modification of generated application behavior
- Potential supply-chain impact if poisoned generated code is distributed
General mitigation guidance
Mitigation generally focuses on ensuring that specification values remain data throughout code generation.
Common defensive patterns include:
- Applying context-aware escaping for every value inserted into string literals
- Using AST-based or structured code-generation APIs instead of raw source concatenation
- Validating OpenAPI path values against an appropriate schema before generation
- Treating specifications from external or semi-trusted sources as untrusted input
- Reviewing generated artifacts before they enter builds or releases
- Running generation and subsequent validation with least-privilege permissions
These controls reduce the chance that specification content can alter generated program structure.
How teams detect issues like this
Organizations can look for this class of issue through:
- Static analysis rules identifying string concatenation or interpolation into generated JavaScript and TypeScript
- Code review checks for unescaped OpenAPI fields used in source templates
- Tests using quotes, backslashes, line terminators, and other syntax-sensitive characters in specification values
- Generated-code validation, parsing, and linting before compilation or publication
- Policy enforcement requiring structured code-generation libraries or approved escaping helpers
Automated security review tools may help identify source-generation paths that incorporate externally controlled values.
