Code Injection in Orval Core Form-Data Serializer

Executive Summary

This vulnerability is a code injection issue in the orval library before version 8.28.0. It occurs in the form-data serializer where property names in OpenAPI schemas are not properly escaped. Attackers can inject ${...} expressions into property names, which execute as live code when the generated client builds FormData bodies. This allows arbitrary code execution with the privileges of the consumer process.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your system uses orval versions prior to 8.28.0. Run commands like 'npm list @orval/core' or 'yarn list @orval/core' to verify the installed version. If the version is below 8.28.0, the system is vulnerable.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to arbitrary code execution on systems using affected versions of orval. Attackers could steal data, modify system behavior, or perform other malicious actions with the same privileges as the application using the generated client. It requires no user interaction or special privileges to exploit.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade to orval version 8.28.0 or later using 'npm install @orval/core@latest' or 'yarn upgrade @orval/core@latest'. Review OpenAPI schemas for suspicious property names containing ${...} patterns and regenerate client code after updating.

Useful 0 Not Useful 0