orval before 8.30.0 Code Injection via Factory Generation
28Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 9.2epss 0.5%
probabilidad de explotación
0.5%top 61% de las CVE
explotación observada
noninguna fuente lo reporta
orval versions before 8.30.0 contain a code injection vulnerability in the @orval/core factory generator that fails to escape date default values in new Date() calls. Attackers can inject arbitrary expressions through apostrophes in OpenAPI schema defaults to execute code with the privileges of the consumer process when factoryMethods and useDates options are enabled.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Productos afectados
orval-labs · orvalReferencias
https://github.com/orval-labs/orvalhttps://github.com/orval-labs/orval/blob/v8.29.0/packages/core/src/generators/factory.ts#L493https://github.com/orval-labs/orval/commit/b9b083576943c683540200eb957feced57dddc1ahttps://github.com/orval-labs/orval/pull/4038https://github.com/orval-labs/orval/security/advisories/GHSA-wx66-36r6-v5g7https://www.vulncheck.com/advisories/orval-before-8.30.0-code-injection-via-factory-generation