Skip to content

chore(deps-dev): update dependency @hey-api/openapi-ts to v0.97.3 [security]#1137

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-hey-api-openapi-ts-vulnerability
Open

chore(deps-dev): update dependency @hey-api/openapi-ts to v0.97.3 [security]#1137
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-hey-api-openapi-ts-vulnerability

Conversation

@renovate

@renovate renovate Bot commented Jul 2, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
@hey-api/openapi-ts (source) 0.95.0 → 0.97.3 age confidence

@​hey-api/openapi-ts's buildClientParams template: prototype chain substitution via unknown $<slot>___proto__ key

CVE-2026-48819 / GHSA-hhx9-57xq-r5rw

More information

Details

Summary

dist/clients/core/params.ts in @hey-api/openapi-ts ships a runtime template that is copied verbatim into every generated SDK as params.gen.ts. When a caller passes an object argument containing an unknown key starting with a slot prefix ($body_, $headers_, $path_, $query_), the function strips the prefix and writes the remainder directly to that slot without validation. The key "$query___proto__" causes the returned params.query object to have its prototype chain substituted with attacker-controlled data. The issue is present in all versions through at least 0.97.2.

Details

The vulnerable branch in dist/clients/core/params.ts:

const extra = extraPrefixes.find(([prefix]) => key.startsWith(prefix))
if (extra) {
  const [prefix, slot] = extra
  ;(params[slot] as Record<string, unknown>)[key.slice(prefix.length)] = value
}

This branch runs for any key that (1) is not registered in the field map and (2) starts with one of the four slot prefixes. When a caller passes "$query___proto__" as an extra key alongside a legitimate field, the key is not in the field map, key.startsWith("$query_") is true, and key.slice(7) produces "__proto__". The bracket-write params["query"]["__proto__"] = value invokes the __proto__ setter, which calls Object.setPrototypeOf(params.query, value).

Reachability. Every generated endpoint method that accepts an object argument passes it through buildClientParams. If the application forwards user-supplied request parameters to a generated client method — a common pattern in proxy servers, BFF layers, and API gateways — an attacker can include "$query___proto__" alongside a legitimate field (e.g. "q"). The legitimate field ensures stripEmptySlots does not remove the affected slot (it has at least one own key), so the poisoned params.query object is returned to the caller.

Concrete field config that hey-api generates for a GET endpoint with one query param q:

// generated by hey-api for: GET /search?q=<string>
buildClientParams([parameters], [{ args: [{ in: "query", key: "q" }] }])

A request { q: "hello", "$query___proto__": { isAdmin: true } } reaches this call with "q" going to the field map branch and "$query___proto__" falling through to extraPrefixes.

PoC
npm install @&#8203;hey-api/[email protected]
cp node_modules/@&#8203;hey-api/openapi-ts/dist/clients/core/params.ts ./params.ts
npx tsx poc.ts

##### or: docker build -t heyapi-poc . && docker run --rm heyapi-poc

poc.ts:

import { buildClientParams } from "./params.ts";

// Generated fields config for GET /search?q=<string>
const generatedFields = [{ args: [{ in: "query" as const, key: "q" }] }];

// Attacker request: legitimate "q" plus injected "$query___proto__"
const result = buildClientParams(
  [{ q: "hello", "$query___proto__": { isAdmin: true } }],
  generatedFields
);

const q = result.query as any;
console.log(q.q);                           // "hello" — own property, normal
console.log(q.isAdmin);                     // true — inherited via prototype chain
console.log(Object.keys(q));               // ["q"] — own keys only
for (const k in result.query) console.log(k); // "q", "isAdmin"

Expected output:

[CONFIRMED] buildClientParams prototype substitution via $query___proto__ key
  Scenario: GET /search with fields [{ in:'query', key:'q' }]
  Attacker request: { q: 'hello', '$query___proto__': { isAdmin: true } }

  result.query.q         = hello
  result.query.isAdmin   = true  ← inherited, NOT own
  Object.keys(q)         = [ 'q' ]
  for..in keys           = q, isAdmin
  Object.getPrototypeOf  = {"isAdmin":true}

No sentinel key is needed. The legitimate field "q" keeps params.query alive through stripEmptySlots.
reproduce.zip

Impact

The returned params.query object has its prototype chain substituted with the attacker-supplied value. Any downstream code that iterates it with for..in (e.g., when serializing query parameters for an outgoing HTTP request) will enumerate the injected keys alongside legitimate ones. Applications that check inherited properties on the params object for routing or authorization decisions are also affected.

Global Object.prototype is not modified — impact is limited to the returned slot object and its consumers.

Every npm package generated by @hey-api/openapi-ts carries this template. Downstream packages include @opencode-ai/sdk, @trigger.dev/sdk, and others. A fix in the template propagates to all of them on regeneration.

Severity

  • CVSS Score: 4.8 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

hey-api/hey-api (@​hey-api/openapi-ts)

v0.97.3

Patch Changes
Updated Dependencies:

v0.97.2

Patch Changes
Updated Dependencies:

v0.97.1

Patch Changes
Updated Dependencies:

v0.97.0

Minor Changes
Changed runtimeConfigPath behavior

This was a known, long-standing issue confusing first-time users. Before, defining client runtimeConfigPath value would paste it verbatim to the generated output. This release changes the behavior to resolve relative to the current working directory the same way output path works.

Changed Ky client behavior

The Ky client was updated to be more intuitive. Some Ky options now need to be passed via the kyOptions field and you need to pass undefined to unset an option.

Patch Changes
Updated Dependencies:

v0.96.1

Patch Changes
Updated Dependencies:

v0.96.0

Minor Changes
Patch Changes
Updated Dependencies:

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@github-actions

github-actions Bot commented Jul 2, 2026

Copy link
Copy Markdown
Contributor

📦 Bundle Size Report

Metric Current Previous Change Status
Total (gzip) 224.04 kB 224.04 kB -4 B (-0.0%) 🟢
Total (raw) 606.31 kB 606.31 kB 0 B (0%) 🟢
CSS (gzip) 20.89 kB 20.89 kB 0 B (0%) 🟢
CSS (raw) 109.09 kB 109.09 kB 0 B (0%) 🟢

Size Limits

  • ✅ Total gzipped: 224.04 kB / 250 kB (89.6%)
  • ✅ Total raw: 606.31 kB / 650 kB (93.3%)
  • ✅ CSS gzipped: 20.89 kB / 25 kB (83.5%)

Largest Files (Top 5)

  1. chunk-Y3CJRZLA.js - 14 kB (0 B (0%))
  2. styles.css - 10.44 kB (0 B (0%))
  3. index.css - 10.44 kB (0 B (0%))
  4. chunk-XCGCCYTF.js - 6.43 kB (0 B (0%))
  5. index.js - 6.32 kB (-2 B (-0.0%))
View All Files (341 total)
File Size (gzip) Change
chunk-Y3CJRZLA.js 14 kB 0 B (0%)
styles.css 10.44 kB 0 B (0%)
index.css 10.44 kB 0 B (0%)
chunk-XCGCCYTF.js 6.43 kB 0 B (0%)
index.js 6.32 kB -2 B (-0.0%)
chunk-BYDNNJHZ.js 6.08 kB 0 B (0%)
chunk-G2LZFGZA.js 5.31 kB 0 B (0%)
chunk-I2F6TCSU.js 4.76 kB 0 B (0%)
chunk-TE2YVMXZ.js 4.57 kB 0 B (0%)
chunk-S4QKVG2B.js 3.89 kB 0 B (0%)

✅ Bundle size check passed

@github-actions

github-actions Bot commented Jul 2, 2026

Copy link
Copy Markdown
Contributor

📊 Coverage Report

⚪ Coverage unchanged

Metric Current Previous Change Status
Lines 88.42% 88.42% 0% ⚪
Statements 87.83% 87.83% 0% ⚪
Functions 84.88% 84.88% 0% ⚪
Branches 79.70% 79.70% 0% ⚪

Detailed Breakdown

Lines Coverage
  • Covered: 3842 / 4345
  • Coverage: 88.42%
  • Change: 0% (0 lines)
Statements Coverage
  • Covered: 3903 / 4444
  • Coverage: 87.83%
  • Change: 0% (0 statements)
Functions Coverage
  • Covered: 1044 / 1230
  • Coverage: 84.88%
  • Change: 0% (0 functions)
Branches Coverage
  • Covered: 2403 / 3015
  • Coverage: 79.70%
  • Change: 0% (0 branches)

✅ Coverage check passed

@github-actions

github-actions Bot commented Jul 2, 2026

Copy link
Copy Markdown
Contributor

Deploy preview for adp-cost-calculator ready!

Project:adp-cost-calculator
Status: ✅  Deploy successful!
Preview URL:https://adp-cost-calculator-glvhigevv-remotecom.vercel.app
Latest Commit:cc464a4

Deployed with vercel-action

@github-actions

github-actions Bot commented Jul 2, 2026

Copy link
Copy Markdown
Contributor

Deploy preview for remote-flows ready!

Project:remote-flows
Status: ✅  Deploy successful!
Preview URL:https://remote-flows-c8f2f01df-remotecom.vercel.app
Latest Commit:cc464a4

Deployed with vercel-action

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants