Executive brief
Orval is a code generator for API clients used by JavaScript developers to automatically create type-safe request and response handling. When generating zod validation schemas, it fails to escape query parameter names, allowing attackers to inject arbitrary JavaScript code that executes when the generated module is imported. An attacker who controls the API specification (OpenAPI/Swagger) can inject malicious code that runs immediately during module load, leading to full system compromise including data theft, code execution, and service disruption.
Technical details
Orval's zod client generator emits query parameter names as unescaped double-quoted keys in zod.object() declarations. A double-quote in a parameter name breaks out of the key string context and enters object-literal context, where an injected computed property key using square bracket notation [expression] is evaluated at module load time. The root cause is missing output encoding (JSON.stringify) on parameter names used as object keys. This occurs at module import time (not runtime), giving attackers no opportunity for defensive intervention. The vulnerability also affects the hono client generator which reuses the same code path. Attack preconditions are minimal: an attacker must be able to supply a malicious OpenAPI/Swagger specification to the code generation step, and the developer must import the generated module. Patched in version 8.21.0; earlier versions through 8.19.0 are confirmed vulnerable.
Affected products
- Orval Labs Orval < 8.21.0
Timeline
- 2026-07-12: disclosed: Published to GitHub Advisory Database
- 2026-08-19: advisory: NVD published advisory for CVE-2026-71865
- 2026-09-03: patched: Version 8.21.0 released with fix