https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 20:52:09 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-71869 <p>Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a ${...} expression or backtick in an array item default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permits attacker-controlled JavaScript to be evaluated when the generated zod schema module is imported, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/zod/src/index.ts function formatDefaultValue. This issue is fixed in version 8.21.0.</p> <p>Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a ${...} expression or backtick in an array item default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permits attacker-controlled JavaScript to be evaluated when the generated zod schema module is imported, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/zod/src/index.ts function formatDefaultValue. This issue is fixed in version 8.21.0.</p> https://db.gcve.eu/vuln/fkie_cve-2026-71869 https://db.gcve.eu/vuln/ghsa-2h9g-j24r-h63g <p><strong>Affected:</strong> npm: orval</p> <p>### Summary</p> <p>Orval&#39;s zod schema generation emits the **array-items** `default` value as a module-level template literal (`export const …Default = `&lt;default&gt;`;`) without escaping `${` or the backtick. A default of the form `v${&lt;code&gt;}w` injects a live JavaScript expression evaluated when the generated zod schema module is imported, executing attacker-controlled code at import — no request or function call needed. Verified on Orval 8.19.0; survives default OpenAPI validation.</p> <p>### Details</p> <p>```ts export const …Default = `v${globalThis.ORVPWN()}w`; // ${...} = arbitrary JS expression, runs at import ```</p> <p>Malicious input: an array property (string items) with a `default` of `v${&lt;attacker JS&gt;}w`. `${...}` permits any JS expression.</p> <p>Note: this is one of several `default`-bearing positions that reach the same unescaped zod template-literal sink; a single fix (escape `default` values) closes all of them, and a CNA may choose to consolidate the related reports.</p> <p>### PoC</p> <p>`reproduce.sh` (+ `make_spec.py`) attached: generates the zod schema with default validation, bundles it, imports it, and shows a marker written at import. Verified on 8.19.0.</p> <p>### Impact</p> <p>Code execution at import in any application that imports a zod schema module generated from an attacker-controlled or attacker-influenced OpenAPI description.</p> <p>### Suggested fix</p> <p>Emit `default` values via a proper string-literal encoder (JSON.stringify, or escape backtick and `${` if a template literal must be used); never interp…</p> <p><strong>Affected:</strong> npm: orval</p> <p>### Summary</p> <p>Orval&#39;s zod schema generation emits the **array-items** `default` value as a module-level template literal (`export const …Default = `&lt;default&gt;`;`) without escaping `${` or the backtick. A default of the form `v${&lt;code&gt;}w` injects a live JavaScript expression evaluated when the generated zod schema module is imported, executing attacker-controlled code at import — no request or function call needed. Verified on Orval 8.19.0; survives default OpenAPI validation.</p> <p>### Details</p> <p>```ts export const …Default = `v${globalThis.ORVPWN()}w`; // ${...} = arbitrary JS expression, runs at import ```</p> <p>Malicious input: an array property (string items) with a `default` of `v${&lt;attacker JS&gt;}w`. `${...}` permits any JS expression.</p> <p>Note: this is one of several `default`-bearing positions that reach the same unescaped zod template-literal sink; a single fix (escape `default` values) closes all of them, and a CNA may choose to consolidate the related reports.</p> <p>### PoC</p> <p>`reproduce.sh` (+ `make_spec.py`) attached: generates the zod schema with default validation, bundles it, imports it, and shows a marker written at import. Verified on 8.19.0.</p> <p>### Impact</p> <p>Code execution at import in any application that imports a zod schema module generated from an attacker-controlled or attacker-influenced OpenAPI description.</p> <p>### Suggested fix</p> <p>Emit `default` values via a proper string-literal encoder (JSON.stringify, or escape backtick and `${` if a template literal must be used); never interp…</p> https://db.gcve.eu/vuln/ghsa-2h9g-j24r-h63g