Summary
Orval versions before 8.29.0 do not properly escape the OpenAPI operationId when placing it into generated TanStack Query mutator-options metadata. A crafted specification may therefore inject JavaScript that executes when an affected generated hook is called, potentially compromising applications or development workflows.
Affected context
The vulnerability occurs in Orval-generated TanStack Query client code when an OpenAPI specification contains a specially crafted operationId. Risk is highest where specifications are accepted from untrusted sources, retrieved from third-party repositories, or incorporated into automated code-generation pipelines without review. The injected content may remain dormant until the corresponding generated hook is invoked.
Exploit preconditions
- Attack surface: OpenAPI-to-TypeScript code generation and generated TanStack Query hooks
- Required access: Ability to supply, modify, or influence an OpenAPI specification used by Orval
- Trigger point: Invocation of a generated hook whose metadata contains the unsafely emitted operationId
- Why exploitation is possible: The operationId is inserted into generated JavaScript without adequate escaping, allowing specification data to be interpreted as executable code
Why this happens
The underlying bug is a failure to treat an OpenAPI operationId as untrusted data when generating JavaScript source code. Instead of encoding the value as a safe string literal or applying context-appropriate escaping, the generator emits it into a metadata object in a way that can alter the resulting program. This behavior maps to CWE-94: Improper Control of Generation of Code, because attacker-influenced specification content crosses into generated executable code.
Potential impact
- Arbitrary JavaScript may execute when affected generated hooks are called
- Application data or credentials may be exposed
- Browser-session actions may be performed in the context of the affected application
- Build, test, or development environments could be compromised if generated code is executed there
- Downstream consumers may receive compromised generated client code
General mitigation guidance
Mitigation generally focuses on preserving a strict boundary between specification data and generated source code.
Common defensive patterns include:
- Encode operationId values as safe JavaScript string literals rather than concatenating raw text
- Apply context-aware escaping to every specification field emitted into executable code
- Validate operationId values against a conservative identifier policy before generation
- Treat OpenAPI documents from external or mutable sources as untrusted input
- Review generated code before execution and isolate generation workflows with minimal privileges
- Prefer secure-by-default generator settings that reject or safely encode unexpected metadata
- Limit credentials, filesystem access, and network permissions available to code-generation and test environments
How teams detect issues like this
Detection can combine source inspection, generated-artifact review, and pipeline controls:
- Use static analysis to identify raw specification values concatenated into JavaScript or TypeScript source
- Review generator code for missing string-literal encoding around operationId and related metadata fields
- Compare generated output against expected syntax and flag unexpected executable constructs
- Add policy checks that validate operationId values and reject unsafe characters or malformed identifiers
- Scan pull requests and generated artifacts for specification-controlled code changes
- Use automated code-review or security-analysis tools to identify code-generation injection patterns
