CVE-2026-71866: Orval zod client import-time RCE via property name injection

CVE-2026-71866 · Severity: critical · CVSS 4 · Published 2026-08-19

Orval is a code generation tool that creates API client libraries from OpenAPI specifications. The zod validator code generator fails to properly escape property names from API schemas when generating JavaScript object definitions, allowing attackers to inject arbitrary code that executes when the generated module is imported. An attacker who controls an OpenAPI specification can craft a malicious property name that breaks out of the string context and injects executable code, leading to remote code execution on systems that generate and import the malicious client.

Technologies: orval (npm). Vendors: npm.

Quick answers

Is CVE-2026-71866 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-71866 being exploited in the wild.
How severe is CVE-2026-71866?
Critical severity, with a CVSS score of 4, published 19 August 2026.
Which products and versions are affected?
orval (npm) < 8.21.0, SEMVER:introduced=0,fixed=8.21.0.
Is there a fix for CVE-2026-71866?
Yes. orval (npm): upgrade to 8.21.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-71866 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-71866?
Check whether you run orval (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • orval (npm): upgrade to 8.21.0 or later
    npm install orval@8.21.0

Technical details

The vulnerability is a code injection flaw (CWE-94, CWE-95, CWE-116) in Orval's zod client code generator. When Orval processes an OpenAPI schema, it generates TypeScript/JavaScript code containing zod validators. Property names from the schema are inserted directly into object literal keys without escaping—e.g., `zod.object({ "propertyName": ... })`. An attacker-controlled property name containing a double-quote character (") breaks out of the string context and lands in object-literal position, where a computed property key `[require("fs").writeFileSync(...)]` is evaluated immediately when the `zod.object({...})` call executes. Since this is an `export const` statement, evaluation occurs at module import time, not call time. The attack requires only that a developer generate code from an attacker-supplied spec and import it; no user interaction or privileges are required. The fix is to properly escape property names using JSON.stringify when generating the object key literal.

Affected products

  • Orval orval < 8.21.0

Identifiers

  • CVE-2026-71866
  • GHSA-6mr6-jvcr-2f25

Timeline

  • 2026-07-12: disclosed: Initially published by maintainer
  • 2026-09-02: advisory: GitHub Advisory Database (GHSA-6mr6-jvcr-2f25) and NVD published
  • 2026-07-12: patched: Fix released in orval v8.21.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.