CVE-2026-71864 in Orval
Summary
by MITRE • 08/19/2026
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a double quote in a header parameter name is emitted into the generated request-validation zod.object({...}) schema without safe encoding. This permits attacker-controlled JavaScript to be evaluated when the generated zod schema module is imported, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/zod/src/index.ts and header request-validation generation. This issue is fixed in version 8.21.0.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/19/2026
The vulnerability identified involves a critical input validation flaw within Orval, an open-source tool designed to generate type-safe JavaScript clients from OpenAPI v3 and Swagger v2 specifications. Specifically, the defect resides in the code generation logic for request-validation schemas using Zod, located in the packages/zod/src/index.ts file. Prior to version 8.21.0, when Orval processes API definitions containing header parameters with double quotes in their names, it fails to properly escape or encode these characters before embedding them into the generated TypeScript schema definition. This oversight results in malformed JavaScript syntax being written directly into the output files, which compromises the integrity of the generated code structure and introduces a severe security risk during the build and execution phases.
From a technical perspective, this flaw constitutes an injection vulnerability where untrusted input derived from external API specifications is interpreted as executable code within the developer's environment. When a header parameter name contains double quotes, such as "X-Custom-Header", Orval incorrectly generates Zod schema definitions that include these raw characters without sanitization. For instance, instead of producing a safe string literal like 'X-Custom-Header', it may produce invalid syntax or code fragments that allow for arbitrary JavaScript execution upon import. This behavior aligns with CWE-79, which describes Cross-site Scripting (XSS) and general injection flaws where untrusted data is sent to an interpreter as part of a command or query. In this context, the interpreter is the Node.js runtime environment executing the generated TypeScript/JavaScript modules during development, continuous integration pipelines, or application startup sequences.
The operational impact of this vulnerability extends beyond simple syntax errors; it enables remote code execution within the contexts where Orval-generated clients are utilized. Since developers routinely import these generated client libraries into their applications to interact with backend services, an attacker who controls the OpenAPI specification can inject malicious payloads that execute when the library is loaded. This poses a significant threat in automated environments such as CI/CD pipelines, where code execution occurs without interactive user oversight, potentially leading to credential theft, supply chain compromise, or lateral movement within internal networks. The vulnerability affects not only local development machines but also production-like testing and staging environments that rely on the integrity of auto-generated client code.
This issue is categorized under ATT&CK technique T1059, Command and Scripting Interpreter, as it allows an attacker to execute arbitrary commands through the misuse of a scripting language interpreter embedded in the build process. It also relates to CWE-20, Improper Input Validation, because the tool fails to adequately sanitize special characters from user-controlled input before processing them into code generation templates. The root cause lies in the lack of robust escaping mechanisms for string literals within the Zod schema generator module, which assumes that header names are safe alphanumeric strings without verifying or encoding potentially dangerous punctuation marks like double quotes.
To mitigate this risk, organizations using Orval must immediately upgrade to version 8.21.0 or later, where the issue has been resolved by implementing proper escaping for special characters in generated schema definitions. Until an update is applied, developers should exercise extreme caution when integrating OpenAPI specifications from untrusted sources into their projects. It is advisable to manually inspect any generated Zod schemas for anomalous syntax before importing them into application codebases. Additionally, security teams should consider adding static analysis rules or linting configurations that detect unexpected string literals in auto-generated files as part of the pre-commit and CI pipeline checks. By treating all external API definitions with the same level of scrutiny as untrusted web input, organizations can prevent similar injection-based attacks from compromising their development infrastructure and application integrity.