CVE-2026-71871: Orval code injection in zod schema generation

CVE-2026-71871 · Severity: critical · CVSS 4 · Published 2026-08-19

Orval is a code generation tool that creates TypeScript validation schemas from API specifications. The tool fails to properly escape user-controlled default values when generating zod schema modules, allowing attackers to inject arbitrary JavaScript code that executes automatically when the generated module is imported—without requiring any API request or function call. This affects applications that use Orval to generate schemas from untrusted or attacker-influenced API specifications.

Technologies: orval (npm). Vendors: npm.

Quick answers

Is CVE-2026-71871 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-71871 being exploited in the wild.
How severe is CVE-2026-71871?
Critical severity, with a CVSS score of 4, published 19 August 2026.
Which products and versions are affected?
orval (npm) < 8.21.0, SEMVER:introduced=0,fixed=8.21.0.
Is there a fix for CVE-2026-71871?
Yes. orval (npm): upgrade to 8.21.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-71871 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-71871?
Check whether you run orval (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • orval (npm): upgrade to 8.21.0 or later
    npm install orval@8.21.0

Technical details

Orval is a code generation library that converts OpenAPI specifications into zod validation schemas. The vulnerability is a code injection flaw (CWE-94, CWE-116) in the zod schema generation logic. When emitting default values for header parameters, Orval constructs a module-level template literal string (`export const Default = \`<value>\`;`) without escaping the input. An attacker can craft an OpenAPI specification with a header parameter default value containing template literal syntax—e.g., `v${globalThis.system_call()}w`—which Orval interpolates directly into the template literal. When the generated zod schema module is imported by any application, the `${...}` expression is evaluated as live JavaScript code, achieving remote code execution. The attack requires no authentication, user interaction, or outbound network call; execution occurs automatically at module import time. The fix requires properly encoding default values (e.g., via JSON.stringify or by escaping backticks and `${` sequences) rather than interpolating them directly into template literals. Patch available in version 8.21.0.

Affected products

  • orval-labs orval < 8.21.0

Identifiers

  • CVE-2026-71871
  • GHSA-8j6p-r8jg-mxqh

Timeline

  • 2026-09-03: disclosed: Published on GitHub Advisory Database
  • 2026-09-03: patched: Version 8.21.0 released with fix (commit 8ef1bfd)
  • 2026-08-19: kev added: Published on NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.