CVE-2026-24132: 
JavaScript vulnerability analysis and mitigation

CVE-2026-24132 is a code injection vulnerability in Orval's mock generation pipeline (@orval/mock) that allows untrusted OpenAPI specifications to inject arbitrary TypeScript/JavaScript into generated mock files via the const keyword on schema properties. It affects Orval versions 6.0.0 through 7.19.0 and 8.0.0-rc.0 through 8.0.2. The vulnerability was disclosed on January 22, 2026, with fixes released the same day. It carries a CVSS v3.1 base score of 9.8 (Critical) and a CVSS v4.0 base score of 7.7 (High) (GitHub Advisory).

The root cause is improper control of code generation (CWE-94) combined with improper neutralization of special elements in a command (CWE-77). The getMockScalar function in packages/mock/src/faker/getters/scalar.ts interpolates const values from OpenAPI schema properties directly into generated TypeScript/JavaScript code without proper escaping or type-safe serialization. An attacker who controls or can supply a malicious OpenAPI specification can craft const values containing JavaScript payloads (e.g., '); require('child_process').execSync('id'); //) that break out of the surrounding string context and inject executable code into generated mock files and faker/MSW handlers. The vulnerability is similar to the previously reported x-enumDescriptions injection (GHSA-h526-wf6g-67jv) but targets a different code path in the faker-based mock generator (GitHub Advisory, PR #2828).

Successful exploitation results in arbitrary code execution on the developer's machine or CI/CD environment at the time the generated mock files are compiled or executed. An attacker can achieve full confidentiality, integrity, and availability impact on the vulnerable system — including reading sensitive files, executing system commands, and disrupting the build pipeline. Because the injected code runs in the context of the developer or build agent, it may enable lateral movement within CI/CD infrastructure or supply chain compromise of downstream applications that consume the generated client code (GitHub Advisory).

A proof-of-concept OpenAPI specification demonstrating the injection (using require('child_process').execSync('id') as a payload) was included in the vulnerability report and confirmed to work on orval@7.19.0 and orval@8.0.2 with mock: true enabled (GitHub Advisory). The EPSS score is approximately 0.072% (0.000720), indicating low current probability of widespread exploitation. No in-the-wild exploitation, threat actor attribution, or CISA KEV catalog listing has been reported. Exploitation requires that a developer or automated pipeline processes an attacker-controlled OpenAPI specification with mock generation enabled.

1. Craft a malicious OpenAPI specification: Create a valid OpenAPI 3.x or Swagger 2.x specification containing a schema property with a const value embedding a JavaScript payload, for example:

components:
  schemas:
    Malicious:
      type: object
      properties:
        EvilString:
          type: string
          const: "'); require('child_process').execSync('id'); //"

2. Deliver the specification to the target: Supply the malicious spec to a developer or CI/CD pipeline that uses Orval with mock: true — for example, by contributing to an open-source project, hosting a public API spec, or via a dependency confusion/supply chain attack.
3. Trigger mock generation: The target runs orval (versions ≤7.19.0 or 8.0.0–8.0.2) against the malicious spec. The getMockScalar function in scalar.ts interpolates the const value directly into the generated TypeScript without sanitization.
4. Code executes: The generated mock file contains the injected payload (e.g., require('child_process').execSync('id')). When the generated file is compiled or executed (e.g., during test runs or build steps), the attacker's code runs in the context of the developer's machine or CI/CD agent (GitHub Advisory, PR #2828).

• File System: Generated mock files (e.g., *.msw.ts, *.mock.ts) containing unexpected JavaScript expressions such as require('child_process'), execSync, eval(, or other Node.js built-in module calls outside of normal faker/MSW patterns.
• File System: Presence of require('child_process').execSync(...) or similar OS command execution patterns within auto-generated TypeScript/JavaScript output files.
• Logs: Build or test runner logs showing unexpected command output (e.g., output of id, whoami, or other shell commands) interleaved with normal compilation output.
• Process: Unexpected child processes spawned by the Node.js/TypeScript compiler or test runner (e.g., sh, bash, cmd.exe) during mock generation or test execution.
• Network: Unexpected outbound network connections from the build environment to external hosts during or immediately after Orval mock generation (GitHub Advisory).

Upgrade @orval/mock to version 7.20.0 (for the 7.x series) or 8.0.3 (for the 8.x series), which fix the vulnerability by replacing direct string interpolation of const values with JSON.stringify() for type-safe serialization (GitHub Advisory, PR #2830). As a workaround, avoid processing untrusted or externally sourced OpenAPI specifications with mock generation (mock: true) enabled until the upgrade is applied. Organizations should also audit any previously generated mock files from untrusted specs for injected code before use in production or CI/CD pipelines.

The vulnerability was discovered and reported by researcher k14uz, who also actively participated in the fix review process — noting that the initial jsStringEscape() fix was insufficient and recommending the use of JSON.stringify() for proper serialization, which was subsequently adopted (PR #2828, PR #2830). The Orval maintainer (melloware) responded promptly, merging fixes for both the v7 and v8 branches on the same day as disclosure (January 22, 2026). No significant broader media coverage or social media discussion beyond the GitHub advisory and automated CVE feeds has been identified.