Executive brief
Orval is a popular code generator that creates validation schemas from OpenAPI specifications. When generating zod validation schemas, it outputs default values into JavaScript template literals without proper escaping. An attacker controlling or modifying an OpenAPI spec can inject JavaScript code that runs automatically when an application imports the generated schema file, gaining full code execution without needing to trigger any specific action or API call.
Technical details
The vulnerability is a template literal code injection (CWE-94, CWE-116, CWE-1336) in Orval's zod schema generator. When processing OpenAPI specifications with array properties containing default values, Orval emits these defaults directly into a template literal pattern like `export const …Default = \`<default>\`;` without escaping backticks or `${...}` sequences. This allows an attacker to craft a default value such as `v${globalThis.ORVPWN()}w`, where the `${...}` syntax is interpreted as a template literal expression and evaluated at import time. No authentication, network interaction, or user action is required—the code executes simply by importing the module. The fix involves properly encoding default values using JSON.stringify or escaping special characters, and this must be applied to all positions where defaults reach template literal sinks. The vulnerability was patched in Orval 8.21.0.
Affected products
- orval-labs Orval < 8.21.0
Timeline
- 2026-07-12: disclosed: GitHub Advisory GHSA-2h9g-j24r-h63g initially published
- 2026-08-19: patched: CVE-2026-71869 published in NVD
- 2026-09-03: other: Advisory formally reviewed and confirmed by GitHub on September 3, 2026; fix released in Orval 8.21.0