VYPR
← All advisories
High severityOSV Advisory· Published Jan 22, 2026· Updated Jan 23, 2026

Orval Mock Generation Code Injection via const

CVE-2026-24132

Description

Orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification. Versions 7.19.0 and below and 8.0.0-rc.0 through 8.0.2 allow untrusted OpenAPI specifications to inject arbitrary TypeScript/JavaScript into generated mock files via the const keyword on schema properties. These const values are interpolated into the mock scalar generator (getMockScalar in packages/mock/src/faker/getters/scalar.ts) without proper escaping or type-safe serialization, which results in attacker-controlled code being emitted into both interface definitions and faker/MSW handlers. The vulnerability is similar in impact to the previously reported enum x-enumDescriptions (GHSA-h526-wf6g-67jv), but it affects a different code path in the faker-based mock generator rather than @orval/core. The issue has been fixed in versions 7.20.0 and 8.0.3.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
@orval/mocknpm
< 7.20.07.20.0
@orval/mocknpm
>= 8.0.0-rc.0, < 8.0.38.0.3

Affected products

1

Patches

3
9b211cddc9f0

fix(mock): escape mocked values (#2830)

https://github.com/orval-labs/orvalMellowareJan 22, 2026via ghsa
commit
1 file changed · +5 −6
  • packages/mock/src/faker/getters/scalar.ts+5 −6 modified
    @@ -3,7 +3,6 @@ import {
   EnumGeneration,
   escape,
   type GeneratorImport,
-  jsStringEscape,
   mergeDeep,
   type MockOptions,
   type OpenApiSchemaObject,
@@ -155,8 +154,8 @@ export function getMockScalar({
           existingReferencedProperties,
           'number',
         );
-      } else if ('const' in item && typeof item.const === 'string') {
-        value = jsStringEscape(item.const);
+      } else if ('const' in item) {
+        value = JSON.stringify(item.const);
       }
 
       return {
@@ -169,8 +168,8 @@ export function getMockScalar({
 
     case 'boolean': {
       let value = 'faker.datatype.boolean()';
-      if ('const' in item && typeof item.const === 'string') {
-        value = jsStringEscape(item.const);
+      if ('const' in item) {
+        value = JSON.stringify(item.const);
       }
       return {
         value,
@@ -259,7 +258,7 @@ export function getMockScalar({
       } else if (item.pattern) {
         value = `faker.helpers.fromRegExp('${item.pattern}')`;
       } else if ('const' in item) {
-        value = `'${jsStringEscape((item as OpenApiSchemaObject).const)}'`;
+        value = JSON.stringify((item as OpenApiSchemaObject).const);
       }
 
       return {
6d8ece07ccb8

fix(mock): v7 escape mocked values (#2829)

https://github.com/orval-labs/orvalMellowareJan 22, 2026via ghsa
commit
1 file changed · +4 −3
  • packages/mock/src/faker/getters/scalar.ts+4 −3 modified
    @@ -2,6 +2,7 @@ import {
   type ContextSpecs,
   EnumGeneration,
   escape,
+  jsStringEscape,
   type GeneratorImport,
   isReference,
   isRootKey,
@@ -154,7 +155,7 @@ export const getMockScalar = ({
           'number',
         );
       } else if ('const' in item) {
-        value = '' + (item as SchemaObject31).const;
+        value = '' + jsStringEscape((item as SchemaObject31).const);
       }
 
       return {
@@ -168,7 +169,7 @@ export const getMockScalar = ({
     case 'boolean': {
       let value = 'faker.datatype.boolean()';
       if ('const' in item) {
-        value = '' + (item as SchemaObject31).const;
+        value = '' + jsStringEscape((item as SchemaObject31).const);
       }
       return {
         value,
@@ -257,7 +258,7 @@ export const getMockScalar = ({
       } else if (item.pattern) {
         value = `faker.helpers.fromRegExp('${item.pattern}')`;
       } else if ('const' in item) {
-        value = `'${(item as SchemaObject31).const}'`;
+        value = `'${jsStringEscape((item as SchemaObject31).const)}'`;
       }
 
       return {
44ca8c1f5f93

fix(mock): escape mocked values (#2828)

https://github.com/orval-labs/orvalMellowareJan 22, 2026via ghsa
commit
1 file changed · +4 −3
  • packages/mock/src/faker/getters/scalar.ts+4 −3 modified
    @@ -3,6 +3,7 @@ import {
   EnumGeneration,
   escape,
   type GeneratorImport,
+  jsStringEscape,
   mergeDeep,
   type MockOptions,
   type OpenApiSchemaObject,
@@ -155,7 +156,7 @@ export function getMockScalar({
           'number',
         );
       } else if ('const' in item && typeof item.const === 'string') {
-        value = item.const;
+        value = jsStringEscape(item.const);
       }
 
       return {
@@ -169,7 +170,7 @@ export function getMockScalar({
     case 'boolean': {
       let value = 'faker.datatype.boolean()';
       if ('const' in item && typeof item.const === 'string') {
-        value = item.const;
+        value = jsStringEscape(item.const);
       }
       return {
         value,
@@ -258,7 +259,7 @@ export function getMockScalar({
       } else if (item.pattern) {
         value = `faker.helpers.fromRegExp('${item.pattern}')`;
       } else if ('const' in item) {
-        value = `'${(item as OpenApiSchemaObject).const}'`;
+        value = `'${jsStringEscape((item as OpenApiSchemaObject).const)}'`;
       }
 
       return {

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

11

News mentions

0

No linked articles in our index yet.