CVE-2026-72716 in Orval
Summary
by MITRE • 08/19/2026
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a ${...} expression or backtick in a query parameter default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permits attacker-controlled JavaScript to be evaluated when the generated zod schema module is imported, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/zod/src/index.ts function formatDefaultValue. This issue is fixed in version 8.21.0.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/19/2026
The vulnerability identified involves a critical server-side template injection flaw within Orval, an open-source tool that generates type-safe JavaScript clients from OpenAPI and Swagger specifications. Specifically affecting versions prior to 8.21.0, the issue resides in the zod schema generation module located at packages/zod/src/index.ts. The root cause is found in the formatDefaultValue function, which processes default values for query parameters defined in API specifications. When a specification includes a query parameter with a default value containing JavaScript template literal syntax, such as ${...} expressions or backticks, Orval fails to properly sanitize these inputs before embedding them into the generated code.
The technical mechanism of this vulnerability relies on how Zod schemas are constructed using TypeScript template literals. During the generation process, if an attacker-controlled API specification contains a malicious default value in a query parameter, that value is directly interpolated into a module-level template literal within the output JavaScript file. Because this interpolation occurs at the time the generated module is imported or executed by Node.js, any embedded code expressions are evaluated immediately. This transforms what appears to be simple data configuration into executable payload delivery, bypassing standard input validation checks typically expected in API schema definitions.
The operational impact of this vulnerability is severe due to its potential for remote code execution within development and deployment environments. Since Orval is commonly used during the build process or by developers locally to generate client libraries from third-party APIs, an attacker could craft a malicious OpenAPI specification hosted on a public registry or service. When a victim imports the generated Zod schema module as part of their application startup or CI pipeline execution, the embedded JavaScript code runs with the privileges of that environment. This can lead to full system compromise, data exfiltration, or lateral movement within internal networks if the development machine or CI runner is connected to sensitive resources.
This flaw aligns with CWE-94 Improper Control of Generation of Code (Code Injection) and maps to MITRE ATT&CK techniques related to command injection via configuration files or scripts. The risk is amplified because it targets the developer workflow rather than a running production service, making traditional runtime security controls less effective at detection. Mitigation requires immediate upgrading to Orval version 8.21.0 or later, where the formatDefaultValue function has been patched to safely encode or escape special characters within default values before they are inserted into template literals. Organizations relying on this tool should audit their CI/CD pipelines and local development environments for any generated code that might have originated from untrusted API specifications prior to applying the patch.