Enrik Mustafa

datamodel-code-generator before 0.84.0 contains a code injection vulnerability that allows attackers to achieve arbitrary code execution by supplying a malicious JSON Schema with a crafted x-python-type annotation containing a string ast.Constant node in a subscript slice position, which bypasses validation in parse python type annotation and python type expr from ast. Attackers can embed malicious Python expressions such as import calls within quoted string literals in the generated source code, which Pydantic v2 evaluates as a ForwardRef via eval() during model rebuild(), resulting in arbitrary code execution on developer workstations, CI/CD pipelines, or applications that generate and import the produced models at runtime.

The @orval/hono generator fails to escape OpenAPI path values within single-quoted route literals. This allows an attacker to craft an OpenAPI document containing an apostrophe in a static path segment, leading to the injection of arbitrary JavaScript code that executes upon the import of the generated TypeScript module.

The @orval/effect generator improperly converts OpenAPI schema defaults into template literals. This allows for code injection where arbitrary JavaScript expressions using the `${...}` syntax can be executed at the module scope during the build or import process of the generated code.

The @orval/core factory generator fails to escape date default values within `new Date()` calls. This allows attackers to inject arbitrary expressions using apostrophes in OpenAPI schema defaults, leading to code execution with the privileges of the consumer process. This issue occurs when the `factoryMethods` and `useDates` options are enabled.

The software fails to escape OpenAPI media-type keys when emitting them into single-quoted Content-Type string literals in generated code. This allows attackers to inject JavaScript via crafted media-type keys in OpenAPI specifications, which then executes when generated fetch operations or mock resolvers are invoked.

A code injection issue exists in the form-data serializer. The component fails to escape multipart property names within generated template literals. This allows attackers to inject `${...}` expressions into OpenAPI schema property names, which are then executed as live interpolation when the generated client constructs FormData bodies using the privileges of the consumer process.

The software fails to escape the `operationId` parameter when emitting it into generated TanStack Query mutator options metadata objects. This allows attackers to inject arbitrary JavaScript code via a crafted `operationId` within an OpenAPI specification, which then executes when the generated hooks are called.

A missing authorization issue exists on the 'drafts' endpoint. This allows an authenticated user with low privileges to bypass role and permission checks and create draft posts. By using only session authentication, an attacker can send requests to the 'drafts' endpoint to create unauthorized drafts that then appear in the administrative drafts queue.