Summary
A critical code injection vulnerability in Orval's form-data serializer fails to escape multipart property names when generating client code from OpenAPI schemas. If an attacker can influence schema property names, injected template expressions may execute with the privileges of the process that builds FormData request bodies.
Affected context
The vulnerability occurs in Orval versions before 8.28.0 when the code generator processes OpenAPI schemas containing attacker-controlled multipart property names. It becomes risky when generated template literals incorporate those names without escaping and the resulting client code later evaluates the injected interpolation in a consumer's build or runtime process.
Exploit preconditions
- Attack surface: OpenAPI schema processing and generated form-data client code
- Required access: Ability to introduce or influence property names in an OpenAPI schema, directly or through a trusted schema supply chain
- Trigger point: Generation or execution of code that builds FormData bodies using the affected serializer
- Why exploitation is possible: Multipart property names are inserted into template literals without escaping, allowing
${...}expressions to be interpreted as live JavaScript interpolation
Why this happens
The underlying bug is failure to treat schema-derived property names as untrusted data before embedding them in generated template literals. Because template literal delimiters and interpolation syntax are not escaped, attacker-controlled names can alter generated program structure and cause expressions to execute. This behavior maps to CWE-94: Improper Control of Generation of Code, where input data influences executable source code.
Potential impact
- Arbitrary JavaScript execution in the client-generation or consuming process
- Exposure of environment variables, source code, credentials, or build artifacts
- Modification of generated files or downstream application behavior
- Compromise of CI/CD agents or developer workstations running affected generation workflows
- Supply-chain propagation through trusted but tampered OpenAPI specifications
General mitigation guidance
Mitigation generally focuses on separating schema data from generated code and reducing trust in externally sourced specifications.
Common defensive patterns include:
- Escaping or safely encoding all schema-derived values before placing them in generated source
- Prefering generation APIs and serialization techniques that do not require dynamic template interpolation
- Validating OpenAPI property names against an appropriate schema and rejecting unexpected control syntax
- Treating specifications from external or semi-trusted sources as untrusted build inputs
- Running code generation with least-privilege identities, isolated build environments, and minimal secret access
- Reviewing generated output before compilation or publication
How teams detect issues like this
Organizations can identify this class of issue through:
- Static analysis rules that flag unescaped schema values embedded in template literals
- Code review checks for dynamic source generation involving
${...}or equivalent interpolation syntax - Tests using property names containing template delimiters and other metacharacters
- Dependency and policy checks for generator components that process untrusted OpenAPI documents
- CI validation that compares generated output against expected safe patterns and prevents unexpected executable constructs
Automated code review and software composition analysis tools may help surface related patterns.
