CyberRota Analysis
AI-GeneratedOrval versions prior to 8.21.0 are vulnerable due to improper handling of double quotes in query parameter names, leading to unsafe JavaScript code execution when the generated zod schema is imported. This critical vulnerability can impact developers, CI/CD pipelines, and application environments, allowing attackers to execute arbitrary code. Organizations using affected versions should prioritize upgrading to version 8.21.0 or later to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a double quote in a query parameter name is emitted into the generated request-validation zod.object({...}) schema without safe encoding. This permits attacker-controlled JavaScript to be evaluated when the generated zod schema module is imported, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/zod/src/index.ts and query request-validation generation. This issue is fixed in version 8.21.0.