CVE-2026-71869 in Orval
Summary
by MITRE • 08/19/2026
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a ${...} expression or backtick in an array item default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permits attacker-controlled JavaScript to be evaluated when the generated zod schema module is imported, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/zod/src/index.ts function formatDefaultValue. This issue is fixed in version 8.21.0.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/20/2026
Orval is a widely utilized tool that generates type-safe JavaScript and TypeScript clients from OpenAPI v3 and Swagger v2 specifications, streamlining the integration of API definitions into frontend and backend applications. The vulnerability identified involves a critical flaw in the code generation logic within version 8.21.0 and earlier releases. Specifically, when generating Zod schemas for validation purposes, the tool processes default values defined in array items. If these default values contain template literal syntax characters such as dollar signs followed by curly braces or backticks, they are emitted directly into a module-level template literal without proper sanitization or encoding. This oversight creates a significant security gap because it allows arbitrary JavaScript expressions to be embedded within the generated code structure rather than being treated as static string data.
The operational impact of this flaw is severe due to the execution context in which these generated modules are typically consumed. When a developer imports the generated Zod schema module, or when automated systems such as CI/CD pipelines, test runners, or application entry points load the module, the JavaScript engine evaluates the template literal. Because the attacker-controlled content was not escaped, any ${...} expression present is interpreted and executed by the runtime environment. This results in remote code execution capabilities for an adversary who can influence the OpenAPI specification used to generate these clients. The attack surface extends beyond just local development machines; it affects continuous integration environments where untrusted specifications might be processed automatically, potentially compromising build servers or test infrastructure that rely on these generated artifacts.
From a classification perspective, this vulnerability aligns with CWE-94 Improper Control of Generation of Code (Code Injection). The root cause lies in the failure to properly neutralize special elements used in code generation, specifically template literals, which leads to unintended command execution. In terms of adversary tactics, this scenario maps to ATT&CK technique T1059 Command and Scripting Interpreter, as it involves the abuse of a scripting engine (JavaScript) to execute arbitrary commands or scripts within the target environment. The vulnerability is particularly dangerous because it exploits the trust developers place in generated code; since the code is produced by an automated tool based on external specifications, users may not scrutinize the output for malicious payloads embedded via template literal syntax.
To mitigate this risk, organizations must immediately upgrade to Orval version 8.21.0 or later, where the issue has been resolved through proper encoding of special characters within default values during schema generation. For environments that cannot yet update, it is advisable to audit existing OpenAPI specifications for any array item defaults containing backticks or template literal syntax and remove or sanitize them before generating client code. Additionally, implementing strict input validation on incoming API specifications can prevent malicious payloads from entering the development pipeline in the first place. Security teams should also consider integrating static analysis tools that flag suspicious patterns in generated JavaScript files to detect potential injection attempts early in the software development lifecycle.