CVE-2026-96754: Orval Hono Generator Code Injection RCE

CVE-2026-96754 Overview

CVE-2026-96754 is a code injection vulnerability in orval versions before 8.29.0. The flaw exists in the @orval/hono generator, which fails to escape OpenAPI path values embedded in single-quoted route literals. An attacker who supplies a malicious OpenAPI document can inject an apostrophe into a static path segment to break out of the string literal. The injected JavaScript executes when the generated TypeScript module is imported by the victim application. This turns any untrusted OpenAPI specification into an arbitrary code execution primitive during code generation or build.

Critical Impact
Attackers can achieve arbitrary JavaScript execution in developer or CI/CD environments simply by having a victim generate code from a crafted OpenAPI document.

Affected Products

orval versions prior to 8.29.0
@orval/hono generator package
@orval/mock route generator (MSW route emission)

Discovery Timeline

2026-09-23 - CVE-2026-96754 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-96754

Vulnerability Analysis

Orval is a code generator that converts OpenAPI specifications into TypeScript clients, mocks, and server route stubs. The @orval/hono generator emits Hono route handlers by interpolating OpenAPI path values directly into single-quoted string literals. Because the generator performs no escaping of the interpolated value, characters that terminate a JavaScript string literal are passed through verbatim into generated source code. The issue is classified under CWE-94: Improper Control of Generation of Code. Impact extends beyond the immediate developer machine because generated artifacts are typically committed to version control and executed by other consumers of the build.

Root Cause

The generator constructs route source text by splicing raw OpenAPI path strings into template literals without calling a string-literal escape routine. An apostrophe in the path prematurely closes the emitted single-quoted string, and any trailing content becomes executable JavaScript in the generated TypeScript file.

Attack Vector

An attacker crafts an OpenAPI document containing a static path segment with an apostrophe followed by arbitrary JavaScript. When a developer or CI job runs Orval against that document, the payload is written into the generated module. The code executes at module import time, giving the attacker execution in the build or runtime context.

typescript

// Patch: packages/hono/src/index.ts
// Adds jsStringLiteralEscape to the sanitization utilities imported
// before OpenAPI values are spliced into generated route literals.
   isObject,
   isOperationInTagBucket,
   jsDoc,
+  jsStringLiteralEscape,
   logWarning,
   type NormalizedMutator,
   type NormalizedOutputOptions,
// Source: https://github.com/orval-labs/orval/commit/d346d94a660e50a2f8d0f7c17fee2c4c69d8dc23

typescript

// Patch: packages/mock/src/faker/getters/route.ts
// getRouteMSW now escapes both baseUrl and route via jsStringLiteralEscape
// before the colon-escape transformation, preventing string-literal breakout.
-import { camelPathParamName, toColonRoutePath } from '@orval/core';
+import {
+  camelPathParamName,
+  jsStringLiteralEscape,
+  toColonRoutePath,
+} from '@orval/core';

export const getRouteMSW = (route: string, baseUrl = '*') =>
-  `${baseUrl}${toColonRoutePath(route.replaceAll(':', String.raw`\\:`), camelPathParamName)}`;
+  `${jsStringLiteralEscape(baseUrl)}${toColonRoutePath(
+    jsStringLiteralEscape(route).replaceAll(':', String.raw`\\:`),
+    camelPathParamName,
+  )}`;
// Source: https://github.com/orval-labs/orval/commit/155a5b7a38ff6886020cbc4c292db57c2793e6b6

Detection Methods for CVE-2026-96754

Indicators of Compromise

Generated TypeScript route files containing unescaped apostrophes, backslashes, or newline characters inside single-quoted route strings.
Unexpected require, import, process, child_process, or network-related identifiers appearing in generated Hono route modules or MSW mock route files.
OpenAPI documents pulled from untrusted registries with paths keys containing ' followed by JavaScript-like tokens.

Detection Strategies

Diff generated Orval output against the source OpenAPI document and alert on any token in generated code not derivable from the specification.
Run static analysis (for example, ESLint with no-eval and custom rules) across generated artifacts to flag suspicious identifiers introduced during code generation.
Scan CI/CD logs for orval invocations followed by anomalous outbound network activity or child-process spawns during the build step.

Monitoring Recommendations

Instrument build agents to record process trees for node, npx, and orval executions and forward the telemetry to a central data lake.
Alert on any modification to package.json, lockfiles, or .env files performed by the build process during Orval code generation.
Track versions of orval and @orval/hono across repositories and flag any pinned version below 8.29.0.

How to Mitigate CVE-2026-96754

Immediate Actions Required

Upgrade orval and @orval/hono to version 8.29.0 or later across all repositories and CI pipelines.
Regenerate any TypeScript modules previously produced from third-party OpenAPI documents and review the diffs for injected content.
Rotate any secrets that were accessible from developer workstations or build agents that ran Orval against untrusted specifications.

Patch Information

The fix is delivered in commits 155a5b7 and d346d94, merged via Pull Request #4006. Both commits route OpenAPI-derived strings through jsStringLiteralEscape before splicing into generated code. Full details are in GHSA-g4mf-q5hw-f9j9 and the VulnCheck advisory.

Workarounds

Restrict Orval code generation to OpenAPI documents from trusted internal sources until upgrades are complete.
Pre-validate OpenAPI specifications and reject any paths key containing ', \, or control characters before invoking the generator.
Run Orval inside an ephemeral, network-restricted container with no access to production secrets or long-lived credentials.

bash

# Upgrade Orval and the Hono generator to a patched release
npm install --save-dev orval@^8.29.0 @orval/hono@^8.29.0

# Verify installed version is 8.29.0 or later
npm ls orval @orval/hono

# Optional: sandbox generation in a network-isolated container
docker run --rm --network=none -v "$PWD":/app -w /app node:20 \
  npx orval --config ./orval.config.ts