CVE-2026-22785: 
JavaScript vulnerability analysis and mitigation

CVE-2026-22785 is a code injection vulnerability in the @orval/mcp npm package, which is part of the orval project — a tool that generates type-safe TypeScript/JavaScript clients from OpenAPI v3 or Swagger v2 specifications. The vulnerability exists in the MCP (Model Context Protocol) server generation logic, which incorporates the summary field from OpenAPI specifications into generated code via string manipulation without proper validation or escaping, allowing an attacker to break out of string literals and inject arbitrary code. All versions prior to 7.18.0 are affected. It was published on January 11, 2026, by the orval maintainer and assigned CVE-2026-22785 on January 12, 2026. The CVSS v3.1 base score is 9.8 (Critical) and the CVSS v4.0 base score is 9.3 (Critical) (Github Advisory, Orval Advisory).

The root cause is classified as CWE-77 (Improper Neutralization of Special Elements used in a Command — Command Injection). In the vulnerable code path within packages/mcp/src/index.ts, the generateServer function constructs JavaScript source code by directly interpolating verbOption.summary (derived from the OpenAPI summary field) into a string template used to register MCP tools via server.tool(...). Because no escaping is applied, an attacker can craft a summary value such as Finds Pets by status.' + require('child_process').execSync("open -a Calculator").toString(),// to terminate the string literal and inject arbitrary Node.js code that executes when the generated server code is run. The fix, applied in commit 80b5fe7, wraps all interpolated values with the jsStringEscape() utility before embedding them in generated code (Orval Advisory, Fix Commit).

Successful exploitation allows an attacker to execute arbitrary code in the build environment at the time the generated MCP server code is run, with the privileges of the process executing it. This poses a significant supply chain risk: if a malicious OpenAPI specification is processed by a CI/CD pipeline using a vulnerable version of orval, the injected code could compromise the build environment, exfiltrate secrets, or embed backdoors into the generated TypeScript clients distributed downstream to end users. Confidentiality, integrity, and availability of the affected build system are all fully compromised (Github Advisory, Orval Advisory).

A public proof-of-concept repository exists at https://github.com/langbyyi/CVE-2026-22785, added to tracking on January 17, 2026 (Feedly). The vulnerability requires no authentication, no special privileges, and no user interaction — an attacker only needs to supply a malicious OpenAPI specification to a developer or pipeline using a vulnerable orval version. The EPSS score is approximately 0.047%, indicating low current exploitation probability. No in-the-wild exploitation or threat actor attribution has been reported, and the vulnerability is not listed in the CISA KEV catalog (Github Advisory).

1. Craft a malicious OpenAPI specification: Create a valid OpenAPI v3 or Swagger v2 YAML/JSON file. In the summary field of any path operation, inject a payload that breaks out of the JavaScript string literal, for example:

   summary: "Finds Pets by status.' + require('child_process').execSync(\"calc.exe\").toString(),//"

2. Deliver the specification to the target: Distribute the malicious spec to a developer or CI/CD pipeline that uses orval (versions < 7.18.0) to generate MCP server code — for example, by submitting it as a pull request, hosting it at a URL consumed by the pipeline, or compromising an upstream API registry.
3. Trigger code generation: The victim runs the orval CLI against the malicious specification (e.g., npx orval --config orval.config.ts), which invokes the generateServer function in @orval/mcp.
4. Injected code executes: The generated index.ts or equivalent server file contains the injected Node.js expression embedded directly in the server.tool(...) call. When the generated server is started (e.g., node generated-server.js), the injected code executes in the Node.js runtime with the privileges of the build/dev process.
5. Achieve objective: The attacker's payload can exfiltrate environment variables (e.g., CI secrets, API keys), establish a reverse shell, or modify other generated files to create a persistent supply chain backdoor (Orval Advisory, Fix Commit).

• File System: Generated MCP server files (e.g., generated-server.ts, index.ts) containing unexpected calls to require('child_process'), execSync, exec, spawn, or other Node.js built-in modules outside of normal orval output patterns.
• File System: OpenAPI specification files (YAML/JSON) with summary fields containing JavaScript syntax characters such as single quotes ('), +, require(, execSync(, or comment markers (//).
• Process: Unexpected child processes spawned by the Node.js runtime during MCP server startup, such as calc.exe, bash, sh, curl, wget, or python.
• Logs: Build or CI/CD logs showing unexpected output or errors during orval code generation, particularly stack traces or stdout from injected execSync calls.
• Network: Unexpected outbound connections from the build server or developer workstation to unknown external IPs or domains immediately following orval code generation or MCP server startup.

Upgrade the @orval/mcp package to version 7.18.0 or later, which applies jsStringEscape() to all user-controlled fields before embedding them in generated code (Fix Commit). As a workaround for environments that cannot immediately upgrade, manually inspect all OpenAPI/Swagger specification files for suspicious content in summary fields — particularly any characters that could break out of a JavaScript string literal — before processing them with orval. Restrict the ability to modify or supply OpenAPI specifications in CI/CD pipelines to authorized personnel only, and treat specifications from untrusted or external sources as potentially malicious (Orval Advisory).

The vulnerability was discussed in the context of broader MCP (Model Context Protocol) security concerns, with commentary noting that classic injection vulnerabilities are now appearing in AI infrastructure tooling (Endor Labs). A blog post on SecurityOnline.info highlighted the supply chain risk angle, framing it as a critical code injection flaw with a CVSS 9.3 score. Developer-focused coverage appeared on Dev.to, describing the attack path from OpenAPI spec to remote code execution. Social media posts on Bluesky also flagged the CVE shortly after disclosure.