CVE-2026-71865 in Orval
Summary
by MITRE • 08/19/2026
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a double quote in a query parameter name is emitted into the generated request-validation zod.object({...}) schema without safe encoding. This permits attacker-controlled JavaScript to be evaluated when the generated zod schema module is imported, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/zod/src/index.ts and query request-validation generation. This issue is fixed in version 8.21.0.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/20/2026
The vulnerability identified involves a critical input validation failure within Orval, an open-source tool designed to generate type-safe JavaScript clients from OpenAPI v3 and Swagger v2 specifications. Specifically, the flaw resides in the code generation logic for query parameter request-validation schemas using the Zod library. Prior to version 8.21.0, when processing API definitions that contain double quotes within query parameter names, Orval fails to properly escape or encode these characters before embedding them into the generated TypeScript schema definition. This oversight results in syntactically invalid JavaScript code being written directly into the output files, specifically affecting the packages/zod/src/index.ts module and related request-validation generation components.
The technical nature of this flaw constitutes a classic case of improper neutralization of special elements used in an input language, which aligns with CWE-74 Improper Neutralization Special Elements in Output Used by a Downstream Component or CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code. When the generated Zod schema module is imported into a project, the unescaped double quote disrupts the string literal structure within the JavaScript code. Depending on how the surrounding context interprets this malformed syntax, it can lead to unexpected token parsing behavior that allows for arbitrary code injection. In many modern build pipelines and development environments, such syntactic anomalies in dynamically evaluated or compiled modules can be exploited to achieve remote code execution if an attacker controls the input specification used by Orval.
The operational impact of this vulnerability is severe because it affects developers who use Orval as part of their continuous integration and deployment workflows. If a malicious actor can influence the OpenAPI or Swagger specifications consumed by Orval, they could inject payloads that execute arbitrary JavaScript code during the build process. This compromises not only the integrity of the generated client libraries but also potentially grants access to sensitive environment variables, secrets stored in CI/CD systems, or internal network resources accessible from the build server. The attack vector is primarily indirect, requiring control over the API specification source rather than direct interaction with a running application, which classifies it under ATT&CK technique T1059 Command and Scripting Interpreter via code injection through supply chain compromise.
Mitigation strategies for this vulnerability are straightforward given that a patch has already been released. Organizations using Orval must immediately upgrade to version 8.21.0 or later, where the issue is resolved by implementing proper escaping mechanisms for special characters within query parameter names during schema generation. For environments unable to update immediately due to dependency constraints, it is advisable to audit all OpenAPI specifications processed by Orval to ensure no untrusted sources are being used and that input validation occurs at the specification level before reaching the code generator. Additionally, developers should enforce strict content security policies in their CI/CD pipelines to limit the execution of arbitrary scripts during build phases, thereby reducing the blast radius if a similar vulnerability were present in other tools within the stack.