Details

Summary

orval's zod client emits each schema property name as a double-quoted key in the generated zod.object({...})
WITHOUT escaping the double quote. A " in a property name closes the key and lands in object-literal
context, where an injected computed property key [expr] is evaluated when zod.object({...}) runs -- which
is at MODULE IMPORT (the export const X = zod.object({...}) executes on load) -> import-time RCE. The
property name is a pure data field. Verified on orval 8.19.0 / Node. CWE-94 / CWE-95 / CWE-116.

Details

export const OpBody = zod.object({ "a":zod.string(),[require("fs").writeFileSync("PWNED","")]:zod.string(),"b": zod.string().optional() })

Sibling: the MSW mock uses a single-quoted key (' breakout, call-time) -- separate report. The TS interface
key is a type (DoS only). Distinct from orval's $ref / route-path / server-url / zod-default findings.

PoC

reproduce.sh (+ make_spec.py) attached: a property name a":zod.string(),[require("fs").writeFileSync("","")]:zod.string(),"b
-> zod.object; evaluating it (= importing the module) writes the marker. Verified on 8.19.0.

Impact

JavaScript / OS command execution (via child_process) at import time for anyone who generates an orval zod
client from an attacker-controlled spec and imports it. Estimated Critical, e.g.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N.

Suggested fix

Escape the property name for the JS string key (JSON.stringify) in the zod.object key generation; never
interpolate a raw property name adjacent to [ ] in object-literal position.
maintainer-report.txt
make_spec.py
reproduce.sh

Severity

• CVSS Score: 9.3 / 10 (Critical)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/orval-labs/orval/security/advisories/GHSA-6mr6-jvcr-2f25
• https://nvd.nist.gov/vuln/detail/CVE-2026-71866
• https://github.com/orval-labs/orval/pull/3692
• https://github.com/orval-labs/orval/commit/8ef1bfdf3f9bcaf9dabfbe2e42887f1c0e159ab6
• https://github.com/orval-labs/orval/releases/tag/v8.21.0
• https://github.com/advisories/GHSA-6mr6-jvcr-2f25

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Details

Summary

Orval's zod schema generation emits the query-parameter default value as a module-level template literal
(export const …Default = ;) without escaping ${ or the backtick. A default of the form
v${<code>}w injects a live JavaScript expression evaluated when the generated zod schema module is
imported, executing attacker-controlled code at import — no request or function call needed. Verified
on Orval 8.19.0; survives default OpenAPI validation.

Details

export const …Default = `v${globalThis.ORVPWN()}w`;   // ${...} = arbitrary JS expression, runs at import

Malicious input: a query parameter with a default of v${<attacker JS>}w. ${...} permits any JS expression.

Note: this is one of several default-bearing positions that reach the same unescaped zod
template-literal sink; a single fix (escape default values) closes all of them, and a CNA may choose
to consolidate the related reports.

PoC

reproduce.sh (+ make_spec.py) attached: generates the zod schema with default validation, bundles
it, imports it, and shows a marker written at import. Verified on 8.19.0.

Impact

Code execution at import in any application that imports a zod schema module generated from an
attacker-controlled or attacker-influenced OpenAPI description.

Suggested fix

Emit default values via a proper string-literal encoder (JSON.stringify, or escape backtick and ${
if a template literal must be used); never interpolate a spec value into a template literal. Apply to
every default position.
maintainer-report.txt
make_spec.py
reproduce.sh

Severity

• CVSS Score: 9.3 / 10 (Critical)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/orval-labs/orval/security/advisories/GHSA-p4cg-3328-rvfg
• https://nvd.nist.gov/vuln/detail/CVE-2026-72716
• https://github.com/orval-labs/orval/pull/3692
• https://github.com/orval-labs/orval/commit/8ef1bfdf3f9bcaf9dabfbe2e42887f1c0e159ab6
• https://github.com/orval-labs/orval/releases/tag/v8.21.0
• https://github.com/advisories/GHSA-p4cg-3328-rvfg

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Details

Summary

Orval resolves OpenAPI $refs by fetching remote http(s) URLs and reading local files (including
absolute / out-of-tree paths), inlining the referenced schema into the generated client. Running
orval on a spec whose $ref points at an attacker/internal URL or an arbitrary local file yields
SSRF, remote file inclusion, and local file inclusion. Verified on 8.19.0. This is a different class
from Orval's published output-injection CVEs (CVE-2026-22785/23947/24132/25141), none of which covers
the $ref resolver.

Details

• $ref: http://attacker/internal-evil.json#/... → build host fetches (SSRF) and inlines the remote
  schema (RFI); confirmed property REMOTE_ORVAL_PROP in the generated client.
• $ref: /abs/path.json#/... or ../../secret.json#/... → out-of-tree local file read + inlined (LFI).

No RCE: on 8.19.0 the description JSDoc is escaped (*/->*\/, the published fix), so $ref content
cannot break out into code. The chain stops at SSRF + RFI + LFI.

Fix: don't resolve remote $refs by default (opt-in + host allowlist); confine local $ref
resolution to the input directory tree (reject absolute paths and ../ escapes).

PoC

reproduce.sh attached: confirms LFI (out-of-tree read), SSRF (listener hit), RFI (remote schema
inlined). Verified on Orval 8.19.0.

Impact

Build-time SSRF from the developer or CI host, disclosure of arbitrary local files, and inclusion of untrusted remote content, from running the generator on an attacker-controlled or attacker-influenced OpenAPI description. No code execution (output escaping is in place post the earlier fixes).

Severity

• CVSS Score: 7.1 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

References

• https://github.com/orval-labs/orval/security/advisories/GHSA-cxq5-97v7-87j8
• https://nvd.nist.gov/vuln/detail/CVE-2026-62680
• https://github.com/orval-labs/orval/pull/3692
• https://github.com/orval-labs/orval/pull/3723
• https://github.com/orval-labs/orval/commit/23786c056f4eba38c02bf2968677988dbbe4de10
• https://github.com/orval-labs/orval/commit/8ef1bfdf3f9bcaf9dabfbe2e42887f1c0e159ab6
• https://github.com/orval-labs/orval/releases/tag/v8.22.0
• https://github.com/advisories/GHSA-cxq5-97v7-87j8

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Details

Summary

orval's zod client emits each header parameter name as a double-quoted key in the generated zod.object({...}) request-validation schema WITHOUT escaping the double quote. A " in the header parameter name closes the key and lands in object-literal context, where an injected computed property key [expr] is evaluated when zod.object({...}) runs -- at MODULE IMPORT (export const OpHeader = zod.object({...}) executes on load) -> import-time RCE. The header parameter name is a pure data field. Verified on orval 8.19.0 / Node.

Details

export const OpHeader = zod.object({ "a":zod.string(),[require("fs").writeFileSync("PWNED","")]:zod.string(),"b": ... })

Also affects the hono client (reuses zod generation). orval escapes values in zod arrays but not keys in zod.object. Sibling fields: schema property name, query parameter name (CVE-96) (separate reports). Distinct from orval's $ref / route-path / server-url / zod-default findings.

PoC

reproduce.sh (+ make_spec.py) attached: a header parameter name that breaks the zod.object key and injects a computed key; evaluating it (= importing the module) writes the marker. Verified on 8.19.0.

Impact

JavaScript / OS command execution at import time for anyone who generates an orval zod client from an attacker-controlled spec and imports it.

Suggested fix

Escape the header parameter name for the JS string key (JSON.stringify) in the zod.object key generation; never interpolate a raw name adjacent to [ ] in object-literal position.

Severity

• CVSS Score: 9.3 / 10 (Critical)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/orval-labs/orval/security/advisories/GHSA-6437-gxhq-pqv8
• https://nvd.nist.gov/vuln/detail/CVE-2026-71864
• https://github.com/orval-labs/orval/pull/3692
• https://github.com/orval-labs/orval/commit/8ef1bfdf3f9bcaf9dabfbe2e42887f1c0e159ab6
• https://github.com/orval-labs/orval/releases/tag/v8.21.0
• https://github.com/advisories/GHSA-6437-gxhq-pqv8

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Details

Summary

orval's zod client emits each query parameter name as a double-quoted key in the generated zod.object({...}) request-validation schema WITHOUT escaping the double quote. A " in the query parameter name closes the key and lands in object-literal context, where an injected computed property key [expr] is evaluated when zod.object({...}) runs -- at MODULE IMPORT (export const OpQueryParams = zod.object({...}) executes on load) -> import-time RCE. The query parameter name is a pure data field. Verified on orval 8.19.0 / Node.

Details

export const OpQueryParams = zod.object({ "a":zod.string(),[require("fs").writeFileSync("PWNED","")]:zod.string(),"b": ... })

Also affects the hono client (reuses zod generation). orval escapes values in zod arrays but not keys in zod.object. Sibling fields: schema property name, header parameter name (CVE-97) (separate reports). Distinct from orval's $ref / route-path / server-url / zod-default findings.

PoC

reproduce.sh (+ make_spec.py) attached: a query parameter name that breaks the zod.object key and injects a computed key; evaluating it (= importing the module) writes the marker. Verified on 8.19.0.

Impact

JavaScript / OS command execution at import time for anyone who generates an orval zod client from an attacker-controlled spec and imports it.

Suggested fix

Escape the query parameter name for the JS string key (JSON.stringify) in the zod.object key generation; never interpolate a raw name adjacent to [ ] in object-literal position. maintainer-report.txt make_spec.py reproduce.sh

Severity

• CVSS Score: 9.3 / 10 (Critical)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/orval-labs/orval/security/advisories/GHSA-653q-5476-x79g
• https://nvd.nist.gov/vuln/detail/CVE-2026-71865
• https://github.com/orval-labs/orval/pull/3692
• https://github.com/orval-labs/orval/commit/8ef1bfdf3f9bcaf9dabfbe2e42887f1c0e159ab6
• https://github.com/orval-labs/orval/releases/tag/v8.21.0
• https://github.com/advisories/GHSA-653q-5476-x79g

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Details

Summary

Orval's zod schema generation emits the enum-typed default value as a module-level template literal (export const …Default = ;) without escaping ${ or the backtick. A default of the form v${<code>}w injects a live JavaScript expression evaluated when the generated zod schema module is imported, executing attacker-controlled code at import — no request or function call needed. Verified on Orval 8.19.0; survives default OpenAPI validation.

Details

export const …Default = `v${globalThis.ORVPWN()}w`;   // ${...} = arbitrary JS expression, runs at import

Malicious input: an enum-typed property with a default of v${<attacker JS>}w. ${...} permits any JS expression.

Note: this is one of several default-bearing positions that reach the same unescaped zod template-literal sink; a single fix (escape default values) closes all of them, and a CNA may choose to consolidate the related reports.

PoC

reproduce.sh (+ make_spec.py) attached: generates the zod schema with default validation, bundles it, imports it, and shows a marker written at import. Verified on 8.19.0.

Impact

Code execution at import in any application that imports a zod schema module generated from an attacker-controlled or attacker-influenced OpenAPI description.

Suggested fix

Emit default values via a proper string-literal encoder (JSON.stringify, or escape backtick and ${ if a template literal must be used); never interpolate a spec value into a template literal. Apply to every default position.

Severity

• CVSS Score: 9.3 / 10 (Critical)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/orval-labs/orval/security/advisories/GHSA-3575-w9fc-c2j6
• https://nvd.nist.gov/vuln/detail/CVE-2026-71868
• https://github.com/orval-labs/orval/pull/3692
• https://github.com/orval-labs/orval/commit/8ef1bfdf3f9bcaf9dabfbe2e42887f1c0e159ab6
• https://github.com/orval-labs/orval/releases/tag/v8.21.0
• https://github.com/advisories/GHSA-3575-w9fc-c2j6

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Details

Summary

orval, when generating MSW mocks (output.mock: true), emits each schema property name as a single-quoted object key in the mock factory WITHOUT escaping the single quote. A ' in a property name closes the key and lands in object-literal context, where an injected computed property key [expr] is evaluated when the mock factory is called (e.g. in tests / MSW handlers) -> RCE. The property name is a pure data field. Verified on orval 8.19.0 / Node.

Details

export const getOpResponseMock = (...): Thing => ({'x': 0, [require("fs").writeFileSync("PWNED","")]: 0, 'y': faker...., ...overrideResponse});

Safe elsewhere: the zod schema double-quotes the property name; the TS interface key is a type (DoS only). Distinct from orval's $ref / route-path / server-url / zod-default findings.

PoC

reproduce.sh (+ make_spec.py) attached: a property name x': 0, [require("fs").writeFileSync("<marker>","")]: 0, 'y -> mock object literal; calling the mock factory writes the marker. Verified on 8.19.0.

Impact

JavaScript / OS command execution (via child_process) on the machine of anyone who generates orval mocks from an attacker controlled spec and runs them (tests / MSW).

Suggested fix

Escape the property name for the JS string key (JSON.stringify), and never interpolate a raw property name adjacent to [ ] in object-literal position.

Severity

• CVSS Score: 9.3 / 10 (Critical)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/orval-labs/orval/security/advisories/GHSA-2w86-xfrc-g85r
• https://nvd.nist.gov/vuln/detail/CVE-2026-71867
• https://github.com/orval-labs/orval/pull/3692
• https://github.com/orval-labs/orval/commit/8ef1bfdf3f9bcaf9dabfbe2e42887f1c0e159ab6
• https://github.com/orval-labs/orval/releases/tag/v8.21.0
• https://github.com/advisories/GHSA-2w86-xfrc-g85r

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Details

Summary

Orval's zod schema generation emits the header-parameter default value as a module-level template literal (export const Default = ;) without escaping ${ or the backtick. A default of the form v${<code>}w injects a live JavaScript expression evaluated when the generated zod schema module is imported, executing attacker-controlled code at import — no request or function call needed. Verified on Orval 8.19.0; survives default OpenAPI validation.

Details

export const …Default = `v${globalThis.ORVPWN()}w`;   // ${...} = arbitrary JS expression, runs at import

Malicious input: a header parameter with a default of v${<attacker JS>}w. ${...} permits any JS expression.

Note: this is one of several default-bearing positions that reach the same unescaped zod template-literal sink; a single fix (escape default values) closes all of them, and a CNA may choose to consolidate the related reports.

PoC

reproduce.sh (+ make_spec.py) attached: generates the zod schema with default validation, bundles it, imports it, and shows a marker written at import. Verified on 8.19.0.

Impact

Code execution at import in any application that imports a zod schema module generated from an attacker-controlled or attacker-influenced OpenAPI description.

Suggested fix

Emit default values via a proper string-literal encoder (JSON.stringify, or escape backtick and ${ if a template literal must be used); never interpolate a spec value into a template literal. Apply to every default position. make_spec.py reproduce.sh

Severity

• CVSS Score: 9.3 / 10 (Critical)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/orval-labs/orval/security/advisories/GHSA-8j6p-r8jg-mxqh
• https://nvd.nist.gov/vuln/detail/CVE-2026-71871
• https://github.com/orval-labs/orval/pull/3692
• https://github.com/orval-labs/orval/commit/8ef1bfdf3f9bcaf9dabfbe2e42887f1c0e159ab6
• https://github.com/orval-labs/orval/releases/tag/v8.21.0
• https://github.com/advisories/GHSA-8j6p-r8jg-mxqh

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Details

Summary

Orval's zod schema generation emits the array-items default value as a module-level template literal (export const …Default = ;) without escaping ${ or the backtick. A default of the form v${<code>}w injects a live JavaScript expression evaluated when the generated zod schema module is imported, executing attacker-controlled code at import — no request or function call needed. Verified on Orval 8.19.0; survives default OpenAPI validation.

Details

export const …Default = `v${globalThis.ORVPWN()}w`;   // ${...} = arbitrary JS expression, runs at import

Malicious input: an array property (string items) with a default of v${<attacker JS>}w. ${...} permits any JS expression.

Note: this is one of several default-bearing positions that reach the same unescaped zod template-literal sink; a single fix (escape default values) closes all of them, and a CNA may choose to consolidate the related reports.

PoC

reproduce.sh (+ make_spec.py) attached: generates the zod schema with default validation, bundles it, imports it, and shows a marker written at import. Verified on 8.19.0.

Impact

Code execution at import in any application that imports a zod schema module generated from an attacker-controlled or attacker-influenced OpenAPI description.

Suggested fix

Emit default values via a proper string-literal encoder (JSON.stringify, or escape backtick and ${ if a template literal must be used); never interpolate a spec value into a template literal. Apply to every default position. maintainer-report.txt make_spec.pyreproduce.sh

Severity

• CVSS Score: 9.3 / 10 (Critical)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/orval-labs/orval/security/advisories/GHSA-2h9g-j24r-h63g
• https://nvd.nist.gov/vuln/detail/CVE-2026-71869
• https://github.com/orval-labs/orval/pull/3692
• https://github.com/orval-labs/orval/commit/8ef1bfdf3f9bcaf9dabfbe2e42887f1c0e159ab6
• https://github.com/orval-labs/orval/releases/tag/v8.21.0
• https://github.com/advisories/GHSA-2h9g-j24r-h63g

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Details

Summary

Orval's zod schema generation emits a schema's default value as a module-level template literal (export const …Default = ;) without escaping ${ or the backtick. A default of the form v${<code>}w injects a live JavaScript expression that is evaluated when the generated zod schema module is imported, executing attacker-controlled code at import — no request or function call needed. Verified on Orval 8.19.0; survives default OpenAPI validation.

Details

export const getIResponseDsDefault = `v${globalThis.ORVPWN()}w`;

${...} permits an arbitrary JS expression. Orval escapes its other value sinks (enum, mock, regex, object-default values) with \' inside single-quoted strings; the string default is the one value emitted as a backtick template literal, so ${...}/backtick are interpreted, not escaped. Distinct from the URL-template-literal cases (different field and sink) and from the published Orval CVEs (summary/MCP, x-enumDescriptions, const/mock).

PoC

reproduce.sh (+ make_spec.py) attached: generates the zod schema with default validation, bundles it, imports it, and shows a marker written at import. Verified on 8.19.0.

Impact

Code execution at import in any application that imports a zod schema module generated from an attacker-controlled or attacker-influenced OpenAPI description.

Suggested fix

Emit default values via a proper string-literal encoder (JSON.stringify, or escape backtick and ${ if a template literal must be used); never interpolate a spec value into a template literal.

maintainer-report.txt
make_spec.py
reproduce.sh

Severity

• CVSS Score: 9.3 / 10 (Critical)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/orval-labs/orval/security/advisories/GHSA-w727-8j6c-2rj4
• https://nvd.nist.gov/vuln/detail/CVE-2026-72717
• https://github.com/orval-labs/orval/pull/3692
• https://github.com/orval-labs/orval/commit/8ef1bfdf3f9bcaf9dabfbe2e42887f1c0e159ab6
• https://github.com/orval-labs/orval/releases/tag/v8.21.0
• https://github.com/advisories/GHSA-w727-8j6c-2rj4

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Details

Summary

When Orval is configured with output.baseUrl.getBaseUrlFromSpecification: true, it bakes the spec's servers[0].url into the generated request URL as a template literal without escaping the backtick. A server URL containing a backtick closes the template literal and injects a concatenation expression evaluated when the generated URL/request function is called, executing attacker-controlled code. Verified on Orval 8.19.0 (fetch client); survives default OpenAPI validation.

Details

return `http://api.x/` + (globalThis.X = require("fs").writeFileSync("/marker","pwned")) + `/v1/u`;

Prerequisite: the documented getBaseUrlFromSpecification: true option (takes the base URL from the OpenAPI servers block). This is the same output sink as the route-path case (request-URL template literal) reached via the server url field. Distinct from Orval's published CVEs (CVE-2026-22785 summary/MCP, CVE-2026-23947 / CVE-2026-25141 x-enumDescriptions, CVE-2026-24132 const/mock).

PoC

reproduce.sh (+ make_spec.py) attached: generates a fetch client with getBaseUrlFromSpecification: true, bundles it, calls the functions, and shows a marker written. Verified on 8.19.0.

Impact

With that option enabled, code execution in any environment that calls a client generated from an attacker-controlled or attacker-influenced OpenAPI description.

Suggested fix

Escape the server URL before emitting it into the URL template literal (escape backtick and ${), or build the base URL with an encoder that treats it as data; validate the URL.
maintainer-report.txt
make_spec.py
reproduce.sh

Severity

• CVSS Score: 9.3 / 10 (Critical)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/orval-labs/orval/security/advisories/GHSA-88f2-fpv8-89q2
• https://nvd.nist.gov/vuln/detail/CVE-2026-62682
• https://github.com/orval-labs/orval/pull/3692
• https://github.com/orval-labs/orval/commit/8ef1bfdf3f9bcaf9dabfbe2e42887f1c0e159ab6
• https://github.com/orval-labs/orval/releases/tag/v8.21.0
• https://github.com/advisories/GHSA-88f2-fpv8-89q2

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Details

Summary

Orval emits the OpenAPI path into the generated request URL as a TEMPLATE LITERAL (`/users/...`) without escaping the backtick character. A path containing a backtick closes the template literal and injects a concatenation expression that is evaluated when the generated URL/request/key function is called, executing attacker-controlled code. Affects the axios, fetch, react-query, and swr clients. Verified on Orval 8.19.0; survives Orval's default OpenAPI validation.

Details

// generated URL builder (fetch client)
return `/users/` + (globalThis.X = require("fs").writeFileSync("/marker","pwned")) + `/list`;

The backtick in the path terminates the `...` literal; + (<code>) + runs as a live expression; a trailing backtick reopens a template literal so the file stays valid. The code runs whenever the generated request function, URL builder, or query-key function is called.

This is distinct from Orval's four published CVEs: CVE-2026-22785 (summary -> MCP server), CVE-2026-23947 / CVE-2026-25141 (x-enumDescriptions), and CVE-2026-24132 (const -> mock files). This is a different field (the route path) and a different sink (the request-URL template literal), which those advisories and their fixes do not cover.

PoC

reproduce.sh (+ make_spec.py) attached: generates a fetch client with default validation, bundles it, calls the generated functions, and shows a marker file written. Verified on 8.19.0.

Impact

Code execution in any environment that calls a client generated from an attacker-controlled or attacker-influenced OpenAPI description (developer, CI, or the running application).

Suggested fix

Escape the path before emitting it into the URL template literal (escape backtick and ${, or build the URL with an encoder that treats the path as data), and validate path characters.

Severity

• CVSS Score: 9.3 / 10 (Critical)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/orval-labs/orval/security/advisories/GHSA-fg9p-mrxr-hvq7
• https://nvd.nist.gov/vuln/detail/CVE-2026-62681
• https://github.com/orval-labs/orval/pull/3692
• https://github.com/orval-labs/orval/commit/8ef1bfdf3f9bcaf9dabfbe2e42887f1c0e159ab6
• https://github.com/orval-labs/orval/releases/tag/v8.21.0
• https://github.com/advisories/GHSA-fg9p-mrxr-hvq7

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

v8.22.0

Compare Source

What's Changed

[!IMPORTANT]
Security Fix is a breaking change that now requires you to configure if you want refs to be external and not traverse directories etc. Please see the docs for how to use and override: https://orval.dev/docs/reference/configuration/input#externalrefs

• fix(core): skip Required for required keys missing from properties by @​Hypenate in #​3721
• fix(angular): send required nullable query params as empty string without a paramsSerializer by @​the-ult in #​3716
• fix(core): gate external $ref resolution behind explicit allow-list by @​aqeelat in #​3723
• Release v8.22.0 by @​github-actions[bot] in #​3725

Full Changelog: orval-labs/orval@v8.21.0...v8.22.0

v8.21.0

Compare Source

What's Changed

• fix(ci): trigger docker image publish on release by @​vondenstein in #​3687
• fix(mock): inline enum values in mocks for union enumGenerationType by @​wadakatu in #​3694
• fix(mock): generate tuple values for OpenAPI 3.1 prefixItems by @​wadakatu in #​3697
• feat: allow zod discriminatedUnion generation by @​titivermeesch in #​3698
• fix(core): only match import alias when detecting used dependencies by @​wadakatu in #​3699
• fix(security): escape spec-controlled strings in generated template literals and object keys by @​aqeelat in #​3692
• fix(axios): eliminate module-level returnTypesToWrite map by @​aqeelat in #​3696
• fix(angular): keep httpResource idle for absent optional request body (#​3700) by @​the-ult in #​3701
• fix(angular): read signals inside the httpResource factory for multi-content-type resources by @​the-ult in #​3715
• fix(mock): use exported element aliases for top-level array responses in arrayItems factories by @​the-ult in #​3709
• feat(core): allow operationName override to decouple type names from method names by @​aqeelat in #​3693
• fix(angular): serialize object query params per OpenAPI style/explode instead of dropping them by @​the-ult in #​3708
• feat(angular): expose request headers and HttpContext on generated httpResource helpers by @​the-ult in #​3717
• Release v8.21.0 by @​github-actions[bot] in #​3720

New Contributors

• @​vondenstein made their first contribution in #​3687

Full Changelog: orval-labs/orval@v8.20.0...v8.21.0

v8.20.0

Compare Source

What's Changed

• fix(zod): emit hoisted sub-models for recursive reusable schemas by @​Spence1115 in #​3652
• fix(fetch): respect OpenAPI default explode: true for array query parameters (#​3231) by @​zeriong in #​3308
• feat(core): support package mutator paths by @​chippleh1392 in #​3653
• feat(docker): add official CLI image and GHCR publish workflow by @​KuldeepGehlot in #​3654
• fix(core): restore Required for allOf required fields lost after normalizeAllOfSchema by @​Noyabronok in #​3655
• docs(clean): clarify clean wipes entire output dirs, not only generated files by @​aqeelat in #​3657
• perf(core): cache $dynamicAnchor fallback index on context by @​aqeelat in #​3659
• docs(output): restructure importPath validation and sync zh translation by @​aqeelat in #​3658
• fix(core): http verbs include OPTIONS by @​melloware in #​3661
• @​orval/mcp: no Zod input schema generated for application/x-www-form-urlencoded request bodies (#​3664) by @​yagop in #​3665
• Adds pkg.pr.new to publish PR preview versions by @​arthurfiorette in #​3668
• Add --bun to PR previews by @​arthurfiorette in #​3669
• Add support for zod/mini generation by @​arthurfiorette in #​3666
• fix(core): combine required from constraint-only allOf overlays by @​wadakatu in #​3674
• build(deps): bump docker/setup-buildx-action from 3 to 4 by @​dependabot[bot] in #​3670
• build(deps): bump docker/build-push-action from 6 to 7 by @​dependabot[bot] in #​3671
• build(deps): bump docker/setup-qemu-action from 3 to 4 by @​dependabot[bot] in #​3672
• build(deps): bump docker/login-action from 3 to 4 by @​dependabot[bot] in #​3673
• docs(zod): correct stale JSDoc left on parseBodyAndResponse by @​yagop in #​3678
• fix(core): support npm-aliased TypeScript versions by @​haydenholligan in #​3677
• fix(core): fix issue when barrel file was re-exporting itself (#​3675) by @​PowerSlime in #​3676
• feat(vue-query): use MaybeRefOrGetter/toValue for reactive params on v5 by @​daugvinasr in #​3679
• test: cover optional security alternatives by @​kriptoburak in #​3680
• fix(mock): register enum value imports from oneOf split mock helpers by @​johncarmack1984 in #​3681
• Release v8.20.0 by @​github-actions[bot] in #​3683

New Contributors

• @​KuldeepGehlot made their first contribution in #​3654
• @​PowerSlime made their first contribution in #​3676
• @​kriptoburak made their first contribution in #​3680
• @​johncarmack1984 made their first contribution in #​3681

Full Changelog: orval-labs/orval@v8.19.0...v8.20.0

v8.19.0

Compare Source

What's Changed

[!NOTE]
Zod v4 is now the default but you can change it to be v3 with a config change

• fix(zod): resolve inline $dynamicAnchor overrides in dynamic scope by @​aqeelat in #​3622
• fix(query): remove unused getHttpFunctionQueryProps by @​daugvinasr in #​3626
• fix: remove dead code and unused files by @​daugvinasr in #​3629
• fix(client): remove isVue from @orval/core by @​daugvinasr in #​3630
• fix(angular): keep httpResource response imports type-only by @​haydenholligan in #​3633
• build(angular): upgrade workspace to angular 22 by @​the-ult in #​3637
• feat(core): add tagsSplitDeduplication option for barrel + shared type extraction by @​aqeelat in #​3558
• refactor(query): route axios isVue flag through the framework adapter by @​daugvinasr in #​3631
• fix(angular): ensure schemas path uses directory path in httpResource split mode by @​the-ult in #​3638
• feat(fetch): add paramsSerializer and arrayFormat support for query params by @​ronderksen in #​3636
• fix(core,hono): generalize the #​3634 tag-identity fix and fix the same bug in hono by @​the-ult in #​3641
• feat(schemas): add splitByTags option to organize schemas by tag by @​aqeelat in #​3595
• build(deps): bump actions/checkout from 6 to 7 by @​dependabot[bot] in #​3646
• fix(core): recover schema-factory imports in single-mode mock writer by @​aqeelat in #​3648
• test(vue-query): align enabled-reactivity samples with #​3241 nullish semantics by @​the-ult in #​3647
• fix(query): avoid mutation operation name shadowing by @​haydenholligan in #​3644
• feat(zod): Make Zod 4 the workspace baseline by @​the-ult in #​3642
• feat(mock): add override.mock.schemas for per-schema property overrides by @​jakiestfu in #​3645
• Release v8.19.0 by @​github-actions[bot] in #​3649

New Contributors

• @​ronderksen made their first contribution in #​3636

Full Changelog: orval-labs/orval@v8.18.0...v8.19.0

v8.18.0

Compare Source

What's Changed

• fix(core): generate requiredNullableParamKeys only if preserveRequire… by @​jjfreez in #​3597
• fix(zod): resolve global zod mutators against output workspace by @​chippleh1392 in #​3598
• fix(mcp): order handler body/query args and propagate optional body to handler + tool schema by @​yagop in #​3600
• fix(query): resolve global query mutators against output workspace by @​chippleh1392 in #​3604
• fix(query): attach queryKey without spreading the react-query result by @​wadakatu in #​3605
• fix(core): use getImportExtension for NodeNext module resolution across all writers by @​aqeelat in #​3603
• feat(zod): coerce single-value array query params via opt-in coerce: ['array'] by @​NathanFichefet in #​3609
• fix(core): escape schema default values in stringify ([#​3583](https://redirect.github.com/orval-labs/orval

✂ Note

PR body was truncated to here.