CyberRota Analysis
AI-GeneratedThe vulnerability affects Orval versions prior to 8.29.0 in Java, where it fails to properly escape OpenAPI media-type keys, allowing attackers to inject malicious JavaScript. This can lead to the execution of arbitrary code during fetch operations or mock resolver invocations, posing a significant risk to applications that utilize this library. Organizations using Orval for API generation should prioritize patching to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
orval before 8.29.0 fails to escape OpenAPI media-type keys when emitting them into single-quoted Content-Type string literals in generated code. Attackers can inject JavaScript through crafted media-type keys in OpenAPI specifications that executes when generated fetch operations or mock resolvers are invoked.