https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 02:33:29 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-71865 <p>Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a double quote in a query parameter name is emitted into the generated request-validation zod.object({...}) schema without safe encoding. This permits attacker-controlled JavaScript to be evaluated when the generated zod schema module is imported, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/zod/src/index.ts and query request-validation generation. This issue is fixed in version 8.21.0.</p> <p>Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a double quote in a query parameter name is emitted into the generated request-validation zod.object({...}) schema without safe encoding. This permits attacker-controlled JavaScript to be evaluated when the generated zod schema module is imported, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/zod/src/index.ts and query request-validation generation. This issue is fixed in version 8.21.0.</p> https://db.gcve.eu/vuln/fkie_cve-2026-71865 https://db.gcve.eu/vuln/ghsa-653q-5476-x79g <p><strong>Affected:</strong> npm: orval</p> <p>### Summary</p> <p>orval&#39;s zod client emits each query parameter name as a double-quoted key in the generated zod.object({...}) request-validation schema WITHOUT escaping the double quote. A &#34; in the query parameter name closes the key and lands in object-literal context, where an injected computed property key [expr] is evaluated when zod.object({...}) runs -- at MODULE IMPORT (export const OpQueryParams = zod.object({...}) executes on load) -&gt; import-time RCE. The query parameter name is a pure data field. Verified on orval 8.19.0 / Node.</p> <p>### Details</p> <p>export const OpQueryParams = zod.object({ &#34;a&#34;:zod.string(),[require(&#34;fs&#34;).writeFileSync(&#34;PWNED&#34;,&#34;&#34;)]:zod.string(),&#34;b&#34;: ... })</p> <p>Also affects the hono client (reuses zod generation). orval escapes values in zod arrays but not keys in zod.object. Sibling fields: schema property name, header parameter name (CVE-97) (separate reports). Distinct from orval&#39;s $ref / route-path / server-url / zod-default findings.</p> <p>### PoC</p> <p>reproduce.sh (+ make_spec.py) attached: a query parameter name that breaks the zod.object key and injects a computed key; evaluating it (= importing the module) writes the marker. Verified on 8.19.0.</p> <p>### Impact</p> <p>JavaScript / OS command execution at import time for anyone who generates an orval zod client from an attacker-controlled spec and imports it.</p> <p>### Suggested fix</p> <p>Escape the query parameter name for the JS string key (JSON.stringify) in the zod.object key generation; never interpolate a raw name adjacent to […</p> <p><strong>Affected:</strong> npm: orval</p> <p>### Summary</p> <p>orval&#39;s zod client emits each query parameter name as a double-quoted key in the generated zod.object({...}) request-validation schema WITHOUT escaping the double quote. A &#34; in the query parameter name closes the key and lands in object-literal context, where an injected computed property key [expr] is evaluated when zod.object({...}) runs -- at MODULE IMPORT (export const OpQueryParams = zod.object({...}) executes on load) -&gt; import-time RCE. The query parameter name is a pure data field. Verified on orval 8.19.0 / Node.</p> <p>### Details</p> <p>export const OpQueryParams = zod.object({ &#34;a&#34;:zod.string(),[require(&#34;fs&#34;).writeFileSync(&#34;PWNED&#34;,&#34;&#34;)]:zod.string(),&#34;b&#34;: ... })</p> <p>Also affects the hono client (reuses zod generation). orval escapes values in zod arrays but not keys in zod.object. Sibling fields: schema property name, header parameter name (CVE-97) (separate reports). Distinct from orval&#39;s $ref / route-path / server-url / zod-default findings.</p> <p>### PoC</p> <p>reproduce.sh (+ make_spec.py) attached: a query parameter name that breaks the zod.object key and injects a computed key; evaluating it (= importing the module) writes the marker. Verified on 8.19.0.</p> <p>### Impact</p> <p>JavaScript / OS command execution at import time for anyone who generates an orval zod client from an attacker-controlled spec and imports it.</p> <p>### Suggested fix</p> <p>Escape the query parameter name for the JS string key (JSON.stringify) in the zod.object key generation; never interpolate a raw name adjacent to […</p> https://db.gcve.eu/vuln/ghsa-653q-5476-x79g