CVE-2026-71867

Orval, a tool that generates client code and mocks from OpenAPI specifications, writes each schema property name into generated MSW mock files as a single-quoted object key without escaping single quotes. When a property name contains a single quote, the key terminates early and any bracketed expression the attacker appended is injected into the object literal as a computed property key, which JavaScript evaluates when the generated mock factory is called (for example in unit tests or MSW handlers). An attacker who controls or can influence the OpenAPI specification processed by orval therefore gains arbitrary JavaScript execution in the developer's Node process and, via child_process, operating-system command execution on the machine that runs the generated mocks. Teams using orval with mock generation enabled (output.mock: true) that consume third-party or otherwise attacker-influenced specifications are affected; the flaw was verified against orval 8.19.0 on Node. No public proof-of-concept or in-the-wild exploitation is currently known, and the flaw is not in CISA's KEV catalog, with an EPSS 30-day exploitation probability of about 0.5%.

What to do: Until a patched orval release is available, avoid running or committing MSW mocks generated by orval 8.19.0 from specifications you do not fully control, or pre-validate schema property names to exclude single quotes and bracket characters. Inspect generated mock files for unexpected computed keys (e.g., expressions invoking require or child_process) before executing tests. Track the orval project for a fix that escapes property names as JSON string keys, and upgrade once a fixed version is published.