Vulnerabilidades de Orval-labs

Orval gera clientes JS com tipagem segura (TypeScript) a partir de qualquer especificação OpenAPI v3 ou Swagger v2 válida. As versões a partir de 7.19.0 e anteriores a 7.21.0 e 8.2.0 possuem uma correção incompleta para o CVE-2026-23947. Embora a função jsStringEscape trate corretamente aspas simples ('), aspas duplas (") e assim por diante, ainda é possível obter injeção de código usando apenas um conjunto limitado de caracteres que atualmente não são escapados. A falha está no fato de que a aplicação pode ser forçada a executar JavaScript arbitrário usando caracteres como []()!+. Por meio de uma técnica conhecida como JSFuck, um atacante pode contornar a lógica de sanitização atual e executar código arbitrário sem precisar de caracteres alfanuméricos ou aspas. A versão 7.21.0 e a 8.2.0 contêm uma correção atualizada.

Orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification. Versions 7.19.0 and below and 8.0.0-rc.0 through 8.0.2 allow untrusted OpenAPI specifications to inject arbitrary TypeScript/JavaScript into generated mock files via the const keyword on schema properties. These const values are interpolated into the mock scalar generator (getMockScalar in packages/mock/src/faker/getters/scalar.ts) without proper escaping or type-safe serialization, which results in attacker-controlled code being emitted into both interface definitions and faker/MSW handlers. The vulnerability is similar in impact to the previously reported enum x-enumDescriptions (GHSA-h526-wf6g-67jv), but it affects a different code path in the faker-based mock generator rather than @orval/core. The issue has been fixed in versions 7.20.0 and 8.0.3.

Orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification. Versions prior to 7.19.0 until 8.0.2 are vulnerable to arbitrary code execution in environments consuming generated clients. This issue is similar in nature to CVE-2026-22785, but affects a different code path in @orval/core that was not addressed by CVE-2026-22785's fix. The vulnerability allows untrusted OpenAPI specifications to inject arbitrary TypeScript/JavaScript code into generated clients via the x-enumDescriptions field, which is embedded without proper escaping in getEnumImplementation(). I have confirmed that the injection occurs during const enum generation and results in executable code within the generated schema files. Orval 7.19.0 and 8.0.2 contain a fix for the issue.

orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification. Prior to 7.18.0, the MCP server generation logic relies on string manipulation that incorporates the summary field from the OpenAPI specification without proper validation or escaping. This allows an attacker to "break out" of the string literal and inject arbitrary code. This vulnerability is fixed in 7.18.0.