Orval npm Package Vulnerability: Import-time RCE via Header Parameter
- Severity
- HIGH
- Affected component
- orval (npm)
- Affected versions
- < 8.21.0 or < 8.22.0 or < 8.21.0
- Patched version
- Not yet available
An early warning has been issued for a high-severity vulnerability in the Orval npm package. The vulnerability, which allows for import-time remote code execution via header parameter name injection, affects versions less than 8.21.0 or 8.22.0.
What happened
An early warning has been issued regarding a vulnerability in the Orval npm package. This vulnerability allows for import-time remote code execution (RCE) via header parameter name injection. The issue arises when generating a zod client from an attacker-controlled spec and importing it. The vulnerability is reportedly under investigation and has not been exploited in the wild.
The vulnerability affects versions of the Orval npm package that are less than 8.21.0 or 8.22.0. Users of these versions are advised to avoid generating zod clients from untrusted sources until a patch is released. It is recommended to monitor for updates and apply them promptly once they become available.
What to do about it
- Avoid generating Orval zod clients from untrusted sources.
- Monitor for updates from the primary sources and apply patches promptly once they are released.
- Consult the primary sources for the most current information on the vulnerability and any available patches.
How 0Day would have caught this
orval is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using a version of the Orval npm package that is less than 8.21.0 or 8.22.0.
What should I do right now?
Avoid generating Orval zod clients from untrusted sources and monitor for updates from the primary sources.
Is there an official fix available?
No official fix has been published yet. Monitor the primary sources for updates.
Sources
- [GHSA-2h9g-j24r-h63g] Orval: Import-time RCE via array-items default -> zod module-level template literal
- [GHSA-2w86-xfrc-g85r] Orval: RCE via schema property name -> computed-property-key injection in the MSW mock generator
- [GHSA-3575-w9fc-c2j6] Orval: Import-time RCE via enum-typed default -> zod module-level template literal
- [GHSA-6437-gxhq-pqv8] Orval: Import-time RCE via header parameter name -> computed-property-key injection in the zod client
- [GHSA-653q-5476-x79g] Orval: Import-time RCE via query parameter name -> computed-property-key injection in the zod cli
- [GHSA-88f2-fpv8-89q2] Orval: RCE via servers[].url -> unescaped request-URL template literal (with getBaseUrlFromSpecification)
- [GHSA-8j6p-r8jg-mxqh] Orval: Import-time RCE via header-parameter default -> zod module-level template literal
- [GHSA-fg9p-mrxr-hvq7] Orval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout)