orval before 8.29.0 fails to escape the operationId parameter when emitting it into generated TanStack Query mutator options metadata objects. Attackers can inject arbitrary JavaScript code through a crafted operationId in an OpenAPI specification that executes when generated hooks are called.
orval @orval/core before 8.28.0 contains a code injection vulnerability in the form-data serializer that fails to escape multipart property names in generated template literals. Attackers can inject ${...} expressions into OpenAPI schema property names that execute as live interpolation when the generated client builds FormData bodies with consumer process privileges.
orval before 8.29.0 fails to escape OpenAPI media-type keys when emitting them into single-quoted Content-Type string literals in generated code. Attackers can inject JavaScript through crafted media-type keys in OpenAPI specifications that executes when generated fetch operations or mock resolvers are invoked.
orval versions before 8.30.0 contain a code injection vulnerability in the @orval/core factory generator that fails to escape date default values in new Date() calls. Attackers can inject arbitrary expressions through apostrophes in OpenAPI schema defaults to execute code with the privileges of the consumer process when factoryMethods and useDates options are enabled.
orval versions 8.14.0 through 8.28.1 contain a code injection vulnerability in the @orval/effect generator that converts OpenAPI schema defaults into template literals. Attackers can inject arbitrary JavaScript expressions via schema defaults containing ${...} syntax, which are executed at module scope when the generated code is built or imported.
orval versions before 8.29.0 contain a code injection vulnerability in the @orval/hono generator that fails to escape OpenAPI path values in single-quoted route literals. Attackers can craft an OpenAPI document with an apostrophe in a static path segment to inject arbitrary JavaScript code that executes when the generated TypeScript module is imported.
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.22.0, Orval resolves remote and local external $ref values without an allowlist or confinement to the input directory. Processing an attacker-controlled OpenAPI description can cause requests from the developer or CI host to attacker-selected or internal HTTP services, read absolute or out-of-tree local files, and inline untrusted remote schemas into generated clients. The affected code is packages/orval/src/import-specs.ts external reference loading. This issue is fixed in version 8.22.0.
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, an unescaped backtick in servers[0].url is emitted into request URL template literals generated when output.baseUrl.getBaseUrlFromSpecification is enabled without safe encoding. This permits attacker-controlled JavaScript to be evaluated when a generated request or URL-builder function is called, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/core/src/getters/route.ts function getFullRoute. This issue is fixed in version 8.21.0.
CVE-2026-72717 is a critical code injection vulnerability in orval-labs' orval tool that generates type-safe JavaScript clients from OpenAPI and Swagger specifications. Versions prior to 8.21.0 improperly handle ${...} expressions or backticks in schema defaults, allowing attacker-controlled JavaScript to be executed when the generated zod schema module is imported. This can lead to code execution in developer, CI, test, or application environments. The issue is fixed in version 8.21.0.
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a single quote in a schema property name is emitted into single-quoted object keys in generated MSW mock factories without safe encoding. This permits attacker-controlled JavaScript to be evaluated when the generated mock factory is called by tests or an MSW handler, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/core/src/getters/keys.ts function getKey and MSW mock generation. This issue is fixed in version 8.21.0.
CVE-2026-71868 is a critical code injection vulnerability in orval-labs' orval tool prior to version 8.21.0. The vulnerability arises because unencoded ${...} expressions or backticks in enum default values are emitted directly into module-level template literals during zod schema generation, allowing attacker-controlled JavaScript code to be executed when the generated module is imported. This can lead to code execution in developer, CI, test, or application environments. The issue is fixed in version 8.21.0.
CVE-2026-71865 is a critical code injection vulnerability in orval-labs' orval tool that generates type-safe JavaScript clients from OpenAPI and Swagger specifications. Versions prior to 8.21.0 improperly handle double quotes in query parameter names, embedding them unsafely into generated zod validation schemas. This flaw allows attacker-controlled JavaScript to be executed when the generated schema module is imported, leading to code execution in developer, CI, test, or application environments. The issue is fixed in version 8.21.0.
CVE-2026-71869 is a critical code injection vulnerability in orval-labs' orval software prior to version 8.21.0. The issue arises from unsafe encoding of ${...} expressions or backticks in array item defaults during zod schema generation, allowing attacker-controlled JavaScript to be executed when the generated module is imported. This can lead to code execution in developer, CI, test, or application environments. The vulnerability is fixed in version 8.21.0.
CVE-2026-71864 is a critical code injection vulnerability in orval-labs orval prior to version 8.21.0. The issue arises because a double quote in a header parameter name is not safely encoded when generating the request-validation zod schema, allowing attacker-controlled JavaScript code to be executed when the generated module is imported. This can lead to code execution in developer, CI, test, or application environments. The vulnerability is fixed in version 8.21.0.
CVE-2026-71871 is a critical code injection vulnerability in orval-labs' orval tool that generates type-safe JavaScript clients from OpenAPI and Swagger specifications. Versions prior to 8.21.0 improperly handle default header parameter values containing ${...} expressions or backticks, embedding attacker-controlled JavaScript into generated zod schema modules. This leads to arbitrary code execution when the module is imported in developer, CI, test, or application environments. The issue is fixed in version 8.21.0.
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a ${...} expression or backtick in a query parameter default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permits attacker-controlled JavaScript to be evaluated when the generated zod schema module is imported, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/zod/src/index.ts function formatDefaultValue. This issue is fixed in version 8.21.0.
CVE-2026-62681 is a critical code injection vulnerability in orval versions prior to 8.21.0. The issue arises because unescaped backticks in OpenAPI paths are directly embedded into JavaScript template literals used for generating request URLs in clients like axios, fetch, react-query, and SWR. This flaw allows attacker-controlled JavaScript code to be executed in environments where the generated code runs, such as developer machines, CI pipelines, test environments, or applications. The vulnerability is fixed in version 8.21.0.
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. From version 8.19.0 until 8.21.0, a double quote in a schema property name is emitted into the generated zod.object({...}) schema without safe encoding. This permits attacker-controlled JavaScript to be evaluated when the generated zod schema module is imported, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/zod/src/index.ts and zod object-key generation. This issue is fixed in version 8.21.0.
Orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification. Versions starting with 7.19.0 and prior to 7.21.0 and 8.2.0 have an incomplete fix for CVE-2026-23947. While the jsStringEscape function properly handles single quotes ('), double quotes (") and so on, it is still possible to achieve code injection using only a limited set of characters that are currently not escaped. The vulnerability lies in the fact that the application can be forced to execute arbitrary JavaScript using characters such as []()!+. By using a technique known as JSFuck, an attacker can bypass the current sanitization logic and run arbitrary code without needing any alphanumeric characters or quotes. Version 7.21.0 and 8.2.0 contain an updated fix.
Orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification. Versions
7.19.0 and below and 8.0.0-rc.0 through 8.0.2 allow untrusted OpenAPI specifications to inject arbitrary TypeScript/JavaScript into generated mock files via the const keyword on schema properties. These const values are interpolated into the mock scalar generator (getMockScalar in packages/mock/src/faker/getters/scalar.ts) without proper escaping or type-safe serialization, which results in attacker-controlled code being emitted into both interface definitions and faker/MSW handlers. The vulnerability is similar in impact to the previously reported enum x-enumDescriptions (GHSA-h526-wf6g-67jv), but it affects a different code path in the faker-based mock generator rather than @orval/core. The issue has been fixed in versions 7.20.0 and 8.0.3.