CVE-2026-71868 in Orval
Summary
by MITRE • 08/19/2026
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a ${...} expression or backtick in an enum default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permits attacker-controlled JavaScript to be evaluated when the generated zod schema module is imported, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/zod/src/index.ts function formatDefaultValue. This issue is fixed in version 8.21.0.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/19/2026
The vulnerability identified involves a critical server-side template injection flaw within Orval, an open-source tool that generates type-safe JavaScript clients from OpenAPI and Swagger specifications. Specifically affecting versions prior to 8.21.0, the issue resides in the zod schema generation module located at packages/zod/src/index.ts, specifically within the formatDefaultValue function. The core technical defect arises when processing enum defaults that contain special characters such as backticks or JavaScript template literal expressions denoted by dollar signs followed by curly braces. Instead of properly escaping these sequences to ensure they are treated as static string data, the generator emits them directly into a module-level template literal without safe encoding. This oversight transforms what should be inert configuration data into executable code within the context of the generated TypeScript module.
When an attacker controls or influences the input specification by injecting malicious payloads such as ${process.env} or similar JavaScript expressions into enum default values, these strings are interpolated directly during the import phase of the generated zod schema module. Because template literals in JavaScript evaluate their contents immediately upon execution, importing a compromised module triggers the evaluation of the injected code. This results in arbitrary command execution within whatever environment processes the generated client library. The impact is severe because it affects not only local development environments but also continuous integration pipelines and production application runtimes that rely on these auto-generated clients to communicate with backend services.
The operational impact extends beyond simple data corruption, as this vulnerability allows for remote code execution if an attacker can manipulate the OpenAPI or Swagger specification used by Orval. This could lead to unauthorized access to sensitive environment variables, exfiltration of secrets stored in CI/CD systems, or further lateral movement within a compromised network infrastructure. The flaw represents a significant risk to supply chain security, as developers often trust generated code without inspecting its internal logic, assuming the tool handles all edge cases safely. This incident highlights the dangers of relying on dynamic code generation tools that do not strictly sanitize user-controlled input before embedding it into executable templates.
To mitigate this vulnerability, organizations must immediately upgrade Orval to version 8.21.0 or later, where the formatDefaultValue function has been patched to properly escape special characters and prevent unintended interpolation. For environments unable to update instantly, manual inspection of generated zod schema files is recommended to identify any suspicious template literal expressions within enum defaults. Additionally, implementing strict input validation on OpenAPI specifications before processing them through Orval can help prevent malicious payloads from entering the generation pipeline. This incident aligns with CWE-94 Improper Control of Generation of Code and ATT&CK technique T1059 Command and Scripting Interpreter, underscoring the need for rigorous sanitization in code generation tools to maintain integrity across development and deployment workflows.