CVE-2026-71865: Orval zod code injection via unescaped query parameter name

CVE-2026-71865 · Severity: critical · CVSS 4 · Published 2026-08-19

Orval is a code generator for API clients used by JavaScript developers to automatically create type-safe request and response handling. When generating zod validation schemas, it fails to escape query parameter names, allowing attackers to inject arbitrary JavaScript code that executes when the generated module is imported. An attacker who controls the API specification (OpenAPI/Swagger) can inject malicious code that runs immediately during module load, leading to full system compromise including data theft, code execution, and service disruption.

Technologies: orval (npm). Vendors: npm.

Quick answers

Is CVE-2026-71865 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-71865 being exploited in the wild.
How severe is CVE-2026-71865?
Critical severity, with a CVSS score of 4, published 19 August 2026.
Which products and versions are affected?
orval (npm) < 8.21.0, SEMVER:introduced=0,fixed=8.21.0.
Is there a fix for CVE-2026-71865?
Yes. orval (npm): upgrade to 8.21.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-71865 attacked?
It is attacked over the network.
Am I affected by CVE-2026-71865?
Check whether you run orval (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • orval (npm): upgrade to 8.21.0 or later
    npm install orval@8.21.0

Technical details

Orval's zod client generator emits query parameter names as unescaped double-quoted keys in zod.object() declarations. A double-quote in a parameter name breaks out of the key string context and enters object-literal context, where an injected computed property key using square bracket notation [expression] is evaluated at module load time. The root cause is missing output encoding (JSON.stringify) on parameter names used as object keys. This occurs at module import time (not runtime), giving attackers no opportunity for defensive intervention. The vulnerability also affects the hono client generator which reuses the same code path. Attack preconditions are minimal: an attacker must be able to supply a malicious OpenAPI/Swagger specification to the code generation step, and the developer must import the generated module. Patched in version 8.21.0; earlier versions through 8.19.0 are confirmed vulnerable.

Affected products

  • Orval Labs Orval < 8.21.0

Identifiers

  • CVE-2026-71865
  • GHSA-653q-5476-x79g

Timeline

  • 2026-07-12: disclosed: Published to GitHub Advisory Database
  • 2026-08-19: advisory: NVD published advisory for CVE-2026-71865
  • 2026-09-03: patched: Version 8.21.0 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.