Summary
Orval contains a code injection flaw in its factory generator because date default values from OpenAPI schemas are not safely escaped when emitted into new Date() calls. When factory generation uses both factoryMethods and useDates, a malicious schema value may cause arbitrary expressions to run with the privileges of the consuming process.
Affected context
The issue occurs in applications or build pipelines that use the Orval core factory generator to process OpenAPI schemas and generate client or factory code. Risk increases when generated factories enable both date handling and factory methods, and when schema documents or their default values can be influenced by an untrusted source.
Exploit preconditions
- Attack surface: OpenAPI schema processing and generated factory code
- Required access: Ability to supply or modify an OpenAPI schema, directly or through a trusted upstream source
- Trigger point: Factory generation for schemas containing date defaults when
factoryMethodsanduseDatesare enabled - Why exploitation is possible: Date defaults are inserted into generated
new Date()expressions without sufficient escaping, allowing schema data to alter generated JavaScript syntax
Why this happens
The vulnerability is caused by treating schema-provided date defaults as data while embedding them into executable JavaScript source code. Apostrophes and related syntax-bearing characters are not safely encoded before interpolation into new Date() calls, allowing attacker-controlled values to escape their intended literal context and introduce expressions.
This maps to CWE-94: Improper Control of Generation of Code ('Code Injection'), because untrusted input influences the structure of generated code rather than remaining confined to a data value.
Potential impact
- The consumer process may execute attacker-controlled JavaScript expressions
- Build or code-generation environments could be compromised
- Repository contents, credentials, or environment data may be exposed
- Generated artifacts could be modified or poisoned
- Downstream systems may be affected if compromised generated code is trusted or distributed
General mitigation guidance
Mitigation generally focuses on preserving the separation between schema data and generated code.
Common defensive patterns include:
- Encoding date defaults as data using language-aware serialization rather than string interpolation
- Applying context-appropriate escaping whenever values are emitted into source code
- Validating date defaults against a strict schema and rejecting unexpected syntax
- Treating OpenAPI documents from external or multi-tenant sources as untrusted
- Generating code in isolated, least-privileged environments with restricted credentials
- Reviewing generated artifacts before execution, publication, or distribution
How teams detect issues like this
Organizations can look for this class of issue through:
- Static analysis for string interpolation into JavaScript or TypeScript source expressions
- Code review checks covering escaping and serialization of schema-derived values
- Tests using quote characters and other syntax-sensitive data in date defaults
- Dependency and software composition analysis for affected generator components
- CI policies that isolate code-generation jobs and prevent generated output from being executed without review
- Automated code review tools that flag unsanitized data flowing into generated source code
