CyberRota Analysis
AI-GeneratedVersions of Orval prior to 8.29.0 are vulnerable to a critical code injection flaw in the @orval/hono generator, which improperly escapes OpenAPI path values in single-quoted route literals. This vulnerability allows attackers to inject arbitrary JavaScript code through crafted OpenAPI documents, leading to potential execution upon importing the generated TypeScript module. Organizations using affected versions of Orval should prioritize immediate updates to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
orval versions before 8.29.0 contain a code injection vulnerability in the @orval/hono generator that fails to escape OpenAPI path values in single-quoted route literals. Attackers can craft an OpenAPI document with an apostrophe in a static path segment to inject arbitrary JavaScript code that executes when the generated TypeScript module is imported.