Orval npm Package Vulnerability: Critical RCE Risk
- Severity
- HIGH
- Affected component
- orval (npm)
- Affected versions
- < 8.21.0 or < 8.21.0 or < 8.21.0 or < 8.21.0 or < 8.21.0 or < 8.22.0 or < 8.21.0
- Patched version
- Not yet available
An early warning has been issued for a critical remote code execution vulnerability in the orval npm package. Users of affected versions are advised to take immediate action.
What happened
An early warning has been issued regarding a critical remote code execution vulnerability in the orval npm package. The vulnerability, tracked as GHSA-2w86-xfrc-g85r, arises when orval generates MSW mocks and emits schema property names as single-quoted object keys without proper escaping. This behavior can lead to remote code execution. Affected versions include those below 8.21.0.
The vulnerability has not been reported as exploited in the wild. However, due to its critical severity, it is strongly recommended that users assess their exposure and apply the necessary fixes.
What to do about it
- Upgrade to orval version 8.21.0 or later to mitigate the risk.
- If upgrading is not possible, manually apply the suggested fix to prevent exploitation.
- Monitor the primary sources for updates on the vulnerability and any additional patches that may be released.
How 0Day would have caught this
orval is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using orval npm package versions below 8.21.0.
What should I do right now?
Upgrade to orval version 8.21.0 or later, or manually apply the suggested fix if upgrading is not possible.
Has this been exploited in the wild?
There are no reports of this vulnerability being exploited in the wild at this time.
Sources
- [GHSA-2h9g-j24r-h63g] Orval: Import-time RCE via array-items default -> zod module-level template literal
- [GHSA-2w86-xfrc-g85r] Orval: RCE via schema property name -> computed-property-key injection in the MSW mock generator
- [GHSA-3575-w9fc-c2j6] Orval: Import-time RCE via enum-typed default -> zod module-level template literal
- [GHSA-6437-gxhq-pqv8] Orval: Import-time RCE via header parameter name -> computed-property-key injection in the zod client
- [GHSA-653q-5476-x79g] Orval: Import-time RCE via query parameter name -> computed-property-key injection in the zod cli
- [GHSA-88f2-fpv8-89q2] Orval: RCE via servers[].url -> unescaped request-URL template literal (with getBaseUrlFromSpecification)
- [GHSA-8j6p-r8jg-mxqh] Orval: Import-time RCE via header-parameter default -> zod module-level template literal
- [GHSA-fg9p-mrxr-hvq7] Orval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout)