CVE-2026-72716: Orval code generation RCE via unescaped template literals in zod schema

CVE-2026-72716 · Severity: critical · CVSS 4 · Published 2026-08-19

Orval is a code generator that produces TypeScript schema validation code (zod) from OpenAPI specifications. When processing query parameter default values, Orval directly injects them into template literals without escaping special characters. An attacker can craft a malicious OpenAPI specification with a default value containing JavaScript expressions (e.g., `v${malicious_code}w`) that execute immediately when the generated schema module is imported into any application, bypassing all runtime protections and allowing full code execution before any application code runs.

Technologies: orval (npm). Vendors: npm.

Quick answers

Is CVE-2026-72716 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-72716 being exploited in the wild.
How severe is CVE-2026-72716?
Critical severity, with a CVSS score of 4, published 19 August 2026.
Which products and versions are affected?
orval (npm) < 8.21.0, SEMVER:introduced=0,fixed=8.21.0.
Is there a fix for CVE-2026-72716?
Yes. orval (npm): upgrade to 8.21.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-72716 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-72716?
Check whether you run orval (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • orval (npm): upgrade to 8.21.0 or later
    npm install orval@8.21.0

Technical details

The vulnerability is a template literal injection (CWE-1336) in Orval's zod code generator. When processing OpenAPI specifications, Orval emits default values using the pattern `export const …Default = `<default value>`;` without escaping backticks or the `${` sequence. An attacker can inject a query parameter with a default of `v${<attacker JS>}w`, where the `${…}` syntax triggers JavaScript expression evaluation at module parse time. This executes during the import statement before any application logic runs, granting the attacker immediate code execution with the full privileges of the importing process. The attack requires the attacker to influence or control the OpenAPI specification fed to Orval (e.g., via a compromised API definition file or man-in-the-middle attack on the spec download). The fix, available in version 8.21.0, properly escapes or encodes all default values using JSON.stringify or equivalent string-literal encoding to prevent template expression injection.

Affected products

  • orval-labs orval < 8.21.0

Identifiers

  • CVE-2026-72716
  • GHSA-p4cg-3328-rvfg

Timeline

  • 2026-09-02: disclosed: GitHub Advisory GHSA-p4cg-3328-rvfg published
  • 2026-09-02: patched: Fix released in Orval 8.21.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.