# CVE-2026-71864: Orval zod client import-time RCE via header parameter name injection

Source: https://junglewise.ai/threats/cve-2026-71864-orval-zod-client-import-time-rce-via-header-parameter-name  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-19. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-71864 · Severity: critical · CVSS 4 · Published 2026-08-19

Orval is a widely-used Node.js code generator that creates TypeScript/JavaScript API clients from OpenAPI specifications. When processing header parameter names, Orval's zod client generation embeds these names directly into JavaScript object keys without escaping special characters. An attacker can craft a malicious OpenAPI specification with specially-crafted header names (containing quotes and JavaScript code) that break out of the string context and execute arbitrary code when the generated client module is imported. This occurs at module load time, before any user code runs, giving attackers complete control over the developer's machine or build environment.

Technologies: [orval (npm)](https://junglewise.ai/threats/technologies/orval). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [Orval Labs](https://junglewise.ai/threats/vendors/orval-labs).

## Quick answers

**Is CVE-2026-71864 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-71864 being exploited in the wild.

**How severe is CVE-2026-71864?** Critical severity, with a CVSS score of 4, published 19 August 2026.

**Which products and versions are affected?** orval (npm) < 8.21.0, SEMVER:introduced=0,fixed=8.21.0; Orval Labs Orval Hono Client < 8.21.0.

**Is there a fix for CVE-2026-71864?** Yes. orval (npm): upgrade to 8.21.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-71864 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-71864?** Check whether you run orval (npm) or Orval Labs Orval Hono Client at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- orval (npm): upgrade to 8.21.0 or later

  ```sh
  npm install orval@8.21.0
  ```


## Technical details

The vulnerability is a code-injection flaw in orval's zod client generator. When emitting zod.object({...}) schemas, header parameter names are inserted as double-quoted string keys without escaping: `{ "headerName": zod.string() }`. If a header name contains a double-quote (e.g., `a",["code"]:x"` ), it closes the string and creates a computed property key context `[expr]` where arbitrary JavaScript expressions are evaluated at object construction time. Since the schema is exported as `export const OpHeader = zod.object({...})`, this code executes synchronously during module import/load, before any application code runs. The attack vector is network-based (via a malicious OpenAPI spec) with no authentication or user interaction required. An attacker can achieve arbitrary OS command execution via Node's `require("child_process")` or similar. Orval 8.21.0 fixes this by properly escaping parameter names using JSON.stringify when generating object keys. The hono client is also affected as it reuses the same zod generation code.

## Affected products

- Orval Labs orval < 8.21.0
- Orval Labs orval hono client < 8.21.0

## Identifiers

- CVE-2026-71864
- GHSA-6437-gxhq-pqv8

## Timeline

- 2026-09-03: disclosed
- 2026-09-03: patched: Version 8.21.0 released with fix

## References

- [https://api.github.com/users/Gal3m](https://api.github.com/users/Gal3m)
- [https://github.com/Gal3m](https://github.com/Gal3m)
- [https://api.github.com/users/Gal3m/gists%7B/gist_id%7D](https://api.github.com/users/Gal3m/gists%7B/gist_id%7D)
- [https://api.github.com/users/Gal3m/repos](https://api.github.com/users/Gal3m/repos)
- [https://avatars.githubusercontent.com/u/91008976?v=4](https://avatars.githubusercontent.com/u/91008976?v=4)
- [https://api.github.com/users/Gal3m/events%7B/privacy%7D](https://api.github.com/users/Gal3m/events%7B/privacy%7D)

## Related threats

- [Orval zod schema code injection via unescaped default value](https://junglewise.ai/threats/cve-2026-72717-orval-zod-schema-code-injection-via-unescaped-default-value)
- [Orval code generation RCE via unescaped template literals in zod schema](https://junglewise.ai/threats/cve-2026-72716-orval-code-generation-rce-via-unescaped-template-literals-in-zod)
- [Orval code injection in zod schema generation](https://junglewise.ai/threats/cve-2026-71871-orval-code-injection-in-zod-schema-generation)
- [Orval code injection in zod schema generation via unescaped template literals](https://junglewise.ai/threats/cve-2026-71869-orval-code-injection-in-zod-schema-generation-via-template)
- [Orval zod code injection via unescaped template literal in default values](https://junglewise.ai/threats/cve-2026-71868-orval-template-literal-injection-in-zod-schema-defaults)