CVE-2026-71869: Orval code injection in zod schema generation via unescaped template literals

CVE-2026-71869 · Severity: critical · CVSS 4 · Published 2026-08-19

Orval is a popular code generator that creates validation schemas from OpenAPI specifications. When generating zod validation schemas, it outputs default values into JavaScript template literals without proper escaping. An attacker controlling or modifying an OpenAPI spec can inject JavaScript code that runs automatically when an application imports the generated schema file, gaining full code execution without needing to trigger any specific action or API call.

Technologies: orval (npm). Vendors: npm.

Quick answers

Is CVE-2026-71869 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-71869 being exploited in the wild.
How severe is CVE-2026-71869?
Critical severity, with a CVSS score of 4, published 19 August 2026.
Which products and versions are affected?
orval (npm) < 8.21.0, SEMVER:introduced=0,fixed=8.21.0.
Is there a fix for CVE-2026-71869?
Yes. orval (npm): upgrade to 8.21.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-71869 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-71869?
Check whether you run orval (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • orval (npm): upgrade to 8.21.0 or later
    npm install orval@8.21.0

Technical details

The vulnerability is a template literal code injection (CWE-94, CWE-116, CWE-1336) in Orval's zod schema generator. When processing OpenAPI specifications with array properties containing default values, Orval emits these defaults directly into a template literal pattern like `export const …Default = \`<default>\`;` without escaping backticks or `${...}` sequences. This allows an attacker to craft a default value such as `v${globalThis.ORVPWN()}w`, where the `${...}` syntax is interpreted as a template literal expression and evaluated at import time. No authentication, network interaction, or user action is required—the code executes simply by importing the module. The fix involves properly encoding default values using JSON.stringify or escaping special characters, and this must be applied to all positions where defaults reach template literal sinks. The vulnerability was patched in Orval 8.21.0.

Affected products

  • orval-labs Orval < 8.21.0

Identifiers

  • CVE-2026-71869
  • GHSA-2h9g-j24r-h63g

Timeline

  • 2026-07-12: disclosed: GitHub Advisory GHSA-2h9g-j24r-h63g initially published
  • 2026-08-19: patched: CVE-2026-71869 published in NVD
  • 2026-09-03: other: Advisory formally reviewed and confirmed by GitHub on September 3, 2026; fix released in Orval 8.21.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.