Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

orval-labs/orval

              master @ 46e9a49
            

Fixes

CVEs

CRITICAL

Peak severity

33.3%

Coverage

Highlights

Code Injection: 3 prior fixes. Scrutinize any change in this area.

(.github/workflows/release-publish.yaml): most-fixed (1 issue). Treat as high-risk during review.

1 high-severity fix in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Code Injection: Generating mock files using unescaped mock constants (`item.const`) allows attackers to inject arbitrary TypeScript/JavaScript code via crafted OpenAPI schemas, leading to remote code execution during developer builds.

Code Injection: Failure to escape enum names and descriptions in OpenAPI specifications during code generation allows malicious spec inputs to inject arbitrary code into target codebases, as seen in `getEnumImplementation()`.

Code Injection: Lack of string escaping during MCP server code generation (for tool names, summaries, and handler references) leaves developers vulnerable to arbitrary code execution when loading third-party specs.