Description
orval versions 8.14.0 through 8.28.1 contain a code injection vulnerability in the @orval/effect generator that converts OpenAPI schema defaults into template literals. Attackers can inject arbitrary JavaScript expressions via schema defaults containing ${...} syntax, which are executed at module scope when the generated code is built or imported.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
orval-labs orval
Default version status: unaffected
8.14.0 to < 8.29.0affected8.29.0unaffected
pkg:npm/orvalReferences
- https://github.com/orval-labs/orval/security/advisories/GHSA-q7f2-jg6j-r867 ↗
- https://github.com/orval-labs/orval/pull/3995 ↗
- https://github.com/orval-labs/orval/commit/d346d94a660e50a2f8d0f7c17fee2c4c69d8dc23 ↗
- https://github.com/orval-labs/orval/blob/v8.28.1/packages/effect/src/index.ts#L298-L302 ↗
- https://github.com/orval-labs/orval ↗
- https://www.vulncheck.com/advisories/orval-orval-effect-8.14.0-through-8.28.1-code-injection ↗