CyberRota Analysis
AI-GeneratedA code injection vulnerability in the form-data serializer of orval @orval/core versions prior to 8.28.0 allows attackers to inject malicious expressions into OpenAPI schema property names, leading to potential execution of arbitrary code during client builds. This critical flaw can compromise the integrity of applications that utilize this library, particularly when generating FormData bodies with consumer process privileges. Developers and organizations using orval should prioritize updating to version 8.28.0 or later to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
orval @orval/core before 8.28.0 contains a code injection vulnerability in the form-data serializer that fails to escape multipart property names in generated template literals. Attackers can inject ${...} expressions into OpenAPI schema property names that execute as live interpolation when the generated client builds FormData bodies with consumer process privileges.