Summary
A critical code injection vulnerability in Orval's @orval/effect generator allows attacker-controlled OpenAPI schema defaults to introduce JavaScript expressions into generated template literals. When the generated code is built or imported, those expressions may execute with the privileges of the build or consuming application process.
Affected context
The vulnerability occurs in Orval configurations that use the @orval/effect generator and process OpenAPI schemas containing untrusted or insufficiently constrained default values. Risk increases when generated source is built, loaded, or imported automatically in a development, CI, package-generation, or application runtime environment.
Exploit preconditions
- Attack surface: OpenAPI schema processing and generated JavaScript source
- Required access: Ability to influence a schema or its default values that the generator consumes
- Trigger point: Generation, build, or import of the affected output
- Why exploitation is possible: Schema defaults are incorporated into template literals without adequately treating their contents as data, allowing expressions to be evaluated in the generated module context
Why this happens
The underlying bug is a failure to distinguish schema data from executable JavaScript syntax. The @orval/effect generator converts OpenAPI defaults into template literals without sufficiently escaping or safely representing expression delimiters. As a result, attacker-controlled content can alter the generated program and execute at module scope, which maps to CWE-94: Improper Control of Generation of Code ('Code Injection').
Potential impact
- Arbitrary JavaScript code may execute in the build or consuming process
- Source code, credentials, tokens, or environment data could be exposed
- CI runners, developer workstations, or application environments could be compromised
- Generated artifacts may be modified or backdoored
- Downstream users may receive tampered packages or source files
General mitigation guidance
Mitigation generally focuses on preserving the boundary between OpenAPI data
and generated code.
Common defensive patterns include:
- Representing schema defaults as serialized data rather than interpolated source expressions
- Escaping or encoding template-literal and expression delimiters before code generation
- Applying strict schema validation and trust controls to imported OpenAPI documents
- Separating generation from automatic execution or import of newly generated code
- Running generators and builds with least-privilege accounts, isolated environments, and minimal secrets
- Reviewing generated artifacts before publication or deployment
How teams detect issues like this
Organizations can identify related risks through:
- Static analysis for template interpolation of schema-derived or otherwise untrusted values
- Code review checks for generated source that embeds data directly into JavaScript expressions
- Tests using boundary characters and expression-like input to verify that output remains inert data
- CI policies that inspect generated artifacts for unexpected executable constructs
- Dependency and build-pipeline monitoring for changes to generator inputs and outputs
Automated code review and software composition analysis tools may help surface these patterns.
