Act nowDisclosed

Advisory · CVE-2026-96754

Critical code injection in orval's Hono generator

An apostrophe in an OpenAPI path segment breaks out of single-quoted route literals in @orval/hono output, injecting arbitrary JavaScript that executes when the generated module is imported.

Advisory published September 23, 2026Independent summary
Vendor
orval-labs
Product
orval
Identifier / CWE
CVE-2026-96754
CWE-94
Action timing
Immediate
ELI5

Explain it like I’m five

orval is a robot that writes code from an API blueprint. A blueprint containing a sneaky apostrophe makes the robot write a trapdoor into the code, and the trapdoor springs open as soon as a developer loads the generated file.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Poisoned spec

    An attacker crafts an OpenAPI document with an apostrophe in a static path segment.

  2. 02Code generation

    The @orval/hono generator emits the path value into a single-quoted route literal without escaping it, injecting attacker JavaScript into the output file.

  3. 03Import

    A developer generates the client and imports the resulting TypeScript module into their project.

  4. 04Execution

    The injected JavaScript runs immediately at import time with the developer's privileges.

What happened

orval versions before 8.29.0 contain a code injection flaw in the @orval/hono generator. OpenAPI path values are interpolated into single-quoted route literals in the generated TypeScript without escaping, so an apostrophe in a static path segment breaks out of the string and injects arbitrary JavaScript. The injected code executes when the generated module is imported, turning a trusted API specification into an execution vector.

The advisory reports orval releases before 8.29.0 as affected and 8.29.0 as fixed. The GitHub security advisory rates the issue critical at CVSS 9.8.

What to do

  1. Inventory projects that use orval’s Hono generator and confirm the orval version.
  2. Upgrade affected projects to orval 8.29.0 or later using the project release guidance.
  3. Treat OpenAPI specifications from untrusted or semi-trusted sources as hostile input until upgraded.
  4. Review recently generated client files for unexpected code outside the expected route definitions.
  5. Check build and developer machines that imported generated code for signs of follow-on activity.

Management note

This is a supply chain shape flaw: the attacker never touches your network, they poison a specification document and wait for a developer to generate and import it. The fix is a version bump, but the exposure window is every generated file produced from an untrusted spec since the vulnerable versions shipped.