CVE-2026-24132: Orval TypeScript Client RCE Vulnerability

CVE-2026-24132 Overview

CVE-2026-24132 is a code injection vulnerability affecting Orval, a popular tool that generates type-safe JavaScript/TypeScript clients from OpenAPI v3 or Swagger v2 specifications. The vulnerability allows attackers to inject arbitrary TypeScript/JavaScript code into generated mock files through maliciously crafted OpenAPI specifications that abuse the const keyword on schema properties.

When Orval processes untrusted OpenAPI specifications, const values are interpolated into the mock scalar generator (getMockScalar in packages/mock/src/faker/getters/scalar.ts) without proper escaping or type-safe serialization. This results in attacker-controlled code being emitted into both interface definitions and faker/MSW (Mock Service Worker) handlers, creating a supply chain attack vector.

Critical Impact

Arbitrary code execution in development environments through malicious OpenAPI specifications that inject TypeScript/JavaScript into generated mock files, potentially compromising developer workstations and CI/CD pipelines.

Affected Products

• Orval versions 7.19.0 and below
• Orval versions 8.0.0-rc.0 through 8.0.2
• Applications using Orval-generated mock files from untrusted OpenAPI specifications

Discovery Timeline

• 2026-01-23 - CVE CVE-2026-24132 published to NVD
• 2026-01-26 - Last updated in NVD database

Technical Details for CVE-2026-24132

Vulnerability Analysis

This vulnerability is classified as CWE-77 (Command Injection) and represents a significant supply chain security risk. The attack requires network access and user interaction (processing an untrusted OpenAPI specification), but requires no privileges to execute.

The vulnerability is similar in impact to a previously reported issue involving enum and x-enumDescriptions (GHSA-h526-wf6g-67jv), but affects a different code path specifically within the faker-based mock generator rather than @orval/core. This means organizations that patched the previous vulnerability may still be susceptible to this attack vector.

The impact extends beyond simple code execution - compromised mock files could exfiltrate sensitive development data, modify build outputs, or establish persistent access within development infrastructure.

Root Cause

The root cause lies in the getMockScalar function within packages/mock/src/faker/getters/scalar.ts. When processing OpenAPI schema properties that contain const values, the function directly interpolates these values into generated TypeScript/JavaScript code without proper escaping or sanitization.

This improper input validation allows specially crafted const values to break out of the expected context and inject arbitrary code that will be executed when the generated mock files are used during development or testing.

Attack Vector

The attack vector is network-based, requiring an attacker to supply a malicious OpenAPI specification to a developer or CI/CD system using a vulnerable version of Orval. The attack scenario involves:

1. An attacker creates a malicious OpenAPI specification with crafted const values containing JavaScript/TypeScript payloads
2. A developer or automated system processes this specification using Orval to generate mock files
3. The malicious code is embedded into the generated interface definitions and faker/MSW handlers
4. When the generated files are imported or executed during development/testing, the injected code runs with the privileges of the Node.js process

The attack requires some user interaction (processing the malicious specification) but the payload delivery mechanism is passive, making it suitable for supply chain attacks through compromised or malicious API documentation repositories.

Detection Methods for CVE-2026-24132

Indicators of Compromise

• Unexpected JavaScript/TypeScript code patterns in generated mock files, particularly within const value assignments
• Unusual string patterns in .ts or .js files generated by Orval that contain characters like backticks, semicolons, or function calls outside expected contexts
• Network connections or file system operations initiated by mock/test processes that should be purely local

Detection Strategies

• Audit OpenAPI specifications from external sources before processing with Orval
• Implement code review processes for all generated mock files before committing to version control
• Use static analysis tools to scan generated TypeScript/JavaScript files for suspicious patterns or injection indicators
• Monitor for unexpected process spawning or network activity during development and testing phases

Monitoring Recommendations

• Enable verbose logging when running Orval against new or updated OpenAPI specifications
• Implement file integrity monitoring on generated mock directories to detect unexpected modifications
• Review CI/CD pipeline logs for anomalous behavior during code generation steps
• Consider sandboxing Orval execution when processing untrusted specifications

How to Mitigate CVE-2026-24132

Immediate Actions Required

• Upgrade Orval to version 7.20.0 or 8.0.3 immediately to remediate this vulnerability
• Audit any mock files previously generated from untrusted or external OpenAPI specifications
• Review all OpenAPI specifications from third-party sources before processing
• Regenerate mock files using the patched version of Orval

Patch Information

The Orval maintainers have released patched versions that properly escape and sanitize const values during mock generation:

• Version 7.20.0 for the 7.x branch - GitHub Release v7.20.0
• Version 8.0.3 for the 8.x branch - GitHub Release v8.0.3

The fix was implemented through multiple pull requests: PR #2828, PR #2829, and PR #2830.

For technical details about the vulnerability and fix, see the GitHub Security Advisory GHSA-f456-rf33-4626.

Workarounds

• Avoid processing OpenAPI specifications from untrusted or unknown sources until patching is complete
• Manually review all generated mock files for suspicious code patterns before use
• Disable mock generation features when processing external specifications if mock functionality is not required
• Implement network isolation for development environments that must process untrusted specifications

# Upgrade Orval to patched version
npm update orval@7.20.0
# or for version 8.x
npm update orval@8.0.3

# Regenerate mock files with patched version
npx orval --config ./orval.config.ts