Summary
Orval generates JavaScript code from OpenAPI specifications without correctly escaping media-type keys placed inside single-quoted Content-Type literals. A crafted specification may therefore inject JavaScript that executes when generated fetch operations or mock resolvers are invoked.
Affected context
The vulnerability occurs in Orval code-generation workflows that process OpenAPI specifications containing attacker-controlled or insufficiently trusted media-type keys. Risk is concentrated in generated fetch clients and mock resolvers where those keys are emitted into JavaScript string literals without context-appropriate escaping.
Exploit preconditions
- Attack surface: OpenAPI specification ingestion and JavaScript code generation
- Required access: Ability to provide, modify, or influence an OpenAPI specification used by Orval
- Trigger point: Invocation of a generated fetch operation or mock resolver
- Why exploitation is possible: Crafted media-type keys are inserted into single-quoted JavaScript literals without adequate escaping, allowing generated source code to contain executable expressions
Why this happens
The underlying flaw is improper output encoding during source-code generation. Media-type values are treated as ordinary data but are emitted into JavaScript string literals without escaping characters that have syntax significance in that context. This behavior maps to CWE-94, Improper Control of Generation of Code, because untrusted specification content can alter the structure and behavior of generated JavaScript.
Potential impact
- Generated code may execute attacker-controlled JavaScript
- Build or test environments running generated clients may be compromised
- Mock services could perform unintended actions when resolvers are invoked
- Credentials, source code, or environment data may be exposed
- Downstream applications may inherit malicious behavior through generated artifacts
General mitigation guidance
Mitigation generally focuses on treating OpenAPI specifications as untrusted
input and preserving a strict separation between data and generated code.
Common defensive patterns include:
- Applying context-aware escaping whenever specification values enter JavaScript source
- Using safe code-generation abstractions rather than manual string interpolation
- Validating media-type keys against the expected syntax and rejecting unexpected characters
- Reviewing generated artifacts before execution or distribution
- Restricting who can modify specifications and separating generation from privileged environments
- Running generation, tests, and mock services with least privilege and minimal secret access
How teams detect issues like this
Useful detection approaches include:
- Static analysis for interpolated OpenAPI values inside JavaScript string literals
- Code review checks for missing escaping at generator output boundaries
- Specification validation policies that constrain media-type keys to valid formats
- Tests using quotation marks, backslashes, and expression-like characters in media-type fields
- Artifact review and CI policies that inspect generated source for unexpected executable syntax
Automated code review and security scanning tools may help identify unsafe
interpolation and missing output-encoding controls.
