Type-Safe JavaScript Client Injection in Orval Tool by Orval Labs

CVE-2026-24132

What is CVE-2026-24132?

Orval, a tool designed to generate type-safe JS clients from OpenAPI specifications, is susceptible to a vulnerability that allows untrusted OpenAPI specifications to inject arbitrary TypeScript or JavaScript into generated mock files. This issue arises due to the improper escaping of const values in schema properties, enabling attacker-controlled code to be emitted into interface definitions and various mock handlers. The vulnerability was found in versions 7.19.0 and below, as well as 8.0.0-rc.0 through 8.0.2, but has been addressed in subsequent releases (7.20.0 and 8.0.3). Developers using Orval should upgrade to these versions to mitigate the risk.

References