A critical code injection vulnerability in orval allows unauthenticated attackers to execute arbitrary JavaScript by providing malicious media-type keys in OpenAPI specifications.

The vulnerability is a code injection flaw (CWE-94) where the generator fails to properly escape media-type keys. This allows an attacker to break out of single-quoted string literals in the generated fetch operations or mock resolvers, enabling arbitrary JavaScript execution when these operations are invoked.

Successful exploitation allows an attacker to execute arbitrary code within the context of the environment where the generated orval code is running. This could lead to full system compromise, exfiltration of sensitive build-time or runtime data, and unauthorized modification of application logic. Given the CVSS score of 9.8, this poses a severe risk to the integrity and confidentiality of the development pipeline and any downstream applications relying on the generated code.

Immediate Action: Update orval-labs orval to version 8.29.0 or later immediately to incorporate the necessary escaping logic.

Proactive Monitoring: Review existing OpenAPI specifications for anomalous or suspicious characters within media-type keys that could be intended for injection attacks.

Compensating Controls: Ensure that OpenAPI specifications are sourced from trusted, internal repositories to prevent malicious input from being processed by the generation engine.

Public Exploit Available: Unknown.

This is a critical vulnerability that necessitates an immediate update to version 8.29.0. Because the flaw exists within the code generation process itself, all projects utilizing older versions of orval must be regenerated after updating to ensure the output code is sanitized. Failure to patch allows for potential remote code execution via malicious OpenAPI definitions, making this a high-priority item for all development and security teams.