Description
orval before 8.29.0 fails to escape OpenAPI media-type keys when emitting them into single-quoted Content-Type string literals in generated code. Attackers can inject JavaScript through crafted media-type keys in OpenAPI specifications that executes when generated fetch operations or mock resolvers are invoked.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| orval-labs | orval | 6.7.1 – < 8.29.0 | 8.29.0 |
References
- GitHub Security Advisory (GHSA-4q3x-rqfw-3x8p) vendor-advisory
- GitHub Security Advisory (GHSA-rcpr-mq4m-jx9j) vendor-advisory
- https://github.com/orval-labs/orval/pull/4007 patch issue-tracking
- https://github.com/orval-labs/orval/commit/43af282d62dca0ef3140023741fb768f6a718adb patch
- https://github.com/orval-labs/orval/commit/a2d4af59f3b167dc8a7a65d15f51cdb89ebe2fe5 patch
- https://github.com/orval-labs/orval/blob/v8.28.1/packages/fetch/src/index.ts#L584 technical-description
- https://github.com/orval-labs/orval product
- VulnCheck Advisory: orval before 8.29.0 Code Injection via unescaped OpenAPI media-type third-party-advisory