CVE-2026-71871 in Orval
Summary
by MITRE • 08/19/2026
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a ${...} expression or backtick in a header parameter default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permits attacker-controlled JavaScript to be evaluated when the generated zod schema module is imported, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/zod/src/index.ts function formatDefaultValue. This issue is fixed in version 8.21.0.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/19/2026
Orval is a widely used tool for generating type-safe JavaScript and TypeScript clients from OpenAPI v3 and Swagger v2 specifications, streamlining the integration of API definitions into frontend and backend applications. A critical security vulnerability was identified within versions prior to 8.21.0 that affects the code generation process specifically when utilizing Zod schema validation libraries. The flaw resides in the packages/zod/src/index.ts file, particularly within the formatDefaultValue function responsible for processing default values defined in API specifications. When a header parameter includes a default value containing template literal syntax such as ${...} expressions or backticks, Orval incorrectly emits this content directly into a module-level template literal without performing any safe encoding or sanitization steps.
This architectural oversight creates a severe server-side code execution risk during the development and build phases rather than at runtime in production environments. Because the generated Zod schema is typically imported as part of the application's initialization or testing suite, the malicious payload contained within the default value string becomes active immediately upon import. An attacker who controls the OpenAPI specification file can inject arbitrary JavaScript code that will be evaluated by the Node.js environment when the developer runs their project, executes continuous integration pipelines, or runs automated tests. This constitutes a classic injection vulnerability where untrusted data is treated as executable code within the context of the development toolchain.
The operational impact extends beyond simple script execution to include potential compromise of sensitive credentials stored in local environments, theft of source code from CI/CD artifacts, and disruption of development workflows through denial-of-service conditions caused by malicious logic. Since developers often run generated client libraries with elevated privileges or within trusted network segments during the build process, this vulnerability can lead to significant supply chain compromises if a third-party API specification is compromised or intentionally crafted for exploitation. The attack vector aligns with CWE-94 Improper Control of Generation of Code (Code Injection) and maps to ATT&CK techniques involving command injection or script parsing vulnerabilities within development tools.
To mitigate this risk, organizations must immediately upgrade Orval to version 8.21.0 or later where the issue has been resolved through proper encoding mechanisms that prevent template literal syntax from being interpreted as executable code. In environments where upgrading is not immediately feasible, developers should audit their OpenAPI specifications for any header parameters containing default values with special characters like backticks or dollar signs and sanitize them manually before generation. Additionally implementing strict input validation on API specification files within CI/CD pipelines can help detect such anomalies early in the development lifecycle preventing malicious code from ever reaching the build stage.