CyberRota Analysis
AI-GeneratedVersions of orval prior to 8.30.0 are vulnerable to a code injection flaw in the @orval/core factory generator, which fails to properly escape date default values in new Date() calls. This allows attackers to inject arbitrary expressions via apostrophes in OpenAPI schema defaults, potentially executing code with the privileges of the consumer process when factoryMethods and useDates options are enabled. Organizations using orval should prioritize patching to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
orval versions before 8.30.0 contain a code injection vulnerability in the @orval/core factory generator that fails to escape date default values in new Date() calls. Attackers can inject arbitrary expressions through apostrophes in OpenAPI schema defaults to execute code with the privileges of the consumer process when factoryMethods and useDates options are enabled.