# CVE-2026-72716: Orval code generation RCE via unescaped template literals in zod schema

Source: https://junglewise.ai/threats/cve-2026-72716-orval-code-generation-rce-via-unescaped-template-literals-in-zod  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-19. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-72716 · Severity: critical · CVSS 4 · Published 2026-08-19

Orval is a code generator that produces TypeScript schema validation code (zod) from OpenAPI specifications. When processing query parameter default values, Orval directly injects them into template literals without escaping special characters. An attacker can craft a malicious OpenAPI specification with a default value containing JavaScript expressions (e.g., `v${malicious_code}w`) that execute immediately when the generated schema module is imported into any application, bypassing all runtime protections and allowing full code execution before any application code runs.

Technologies: [orval (npm)](https://junglewise.ai/threats/technologies/orval). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-72716 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-72716 being exploited in the wild.

**How severe is CVE-2026-72716?** Critical severity, with a CVSS score of 4, published 19 August 2026.

**Which products and versions are affected?** orval (npm) < 8.21.0, SEMVER:introduced=0,fixed=8.21.0.

**Is there a fix for CVE-2026-72716?** Yes. orval (npm): upgrade to 8.21.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-72716 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-72716?** Check whether you run orval (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- orval (npm): upgrade to 8.21.0 or later

  ```sh
  npm install orval@8.21.0
  ```


## Technical details

The vulnerability is a template literal injection (CWE-1336) in Orval's zod code generator. When processing OpenAPI specifications, Orval emits default values using the pattern `export const …Default = `<default value>`;` without escaping backticks or the `${` sequence. An attacker can inject a query parameter with a default of `v${<attacker JS>}w`, where the `${…}` syntax triggers JavaScript expression evaluation at module parse time. This executes during the import statement before any application logic runs, granting the attacker immediate code execution with the full privileges of the importing process. The attack requires the attacker to influence or control the OpenAPI specification fed to Orval (e.g., via a compromised API definition file or man-in-the-middle attack on the spec download). The fix, available in version 8.21.0, properly escapes or encodes all default values using JSON.stringify or equivalent string-literal encoding to prevent template expression injection.

## Affected products

- orval-labs orval < 8.21.0

## Identifiers

- CVE-2026-72716
- GHSA-p4cg-3328-rvfg

## Timeline

- 2026-09-02: disclosed: GitHub Advisory GHSA-p4cg-3328-rvfg published
- 2026-09-02: patched: Fix released in Orval 8.21.0

## References

- [https://api.github.com/users/Gal3m](https://api.github.com/users/Gal3m)
- [https://github.com/Gal3m](https://github.com/Gal3m)
- [https://api.github.com/users/Gal3m/gists%7B/gist_id%7D](https://api.github.com/users/Gal3m/gists%7B/gist_id%7D)
- [https://api.github.com/users/Gal3m/repos](https://api.github.com/users/Gal3m/repos)
- [https://avatars.githubusercontent.com/u/91008976?v=4](https://avatars.githubusercontent.com/u/91008976?v=4)
- [https://api.github.com/users/Gal3m/events%7B/privacy%7D](https://api.github.com/users/Gal3m/events%7B/privacy%7D)

## Related threats

- [Orval zod schema code injection via unescaped default value](https://junglewise.ai/threats/cve-2026-72717-orval-zod-schema-code-injection-via-unescaped-default-value)
- [Orval code injection in zod schema generation](https://junglewise.ai/threats/cve-2026-71871-orval-code-injection-in-zod-schema-generation)
- [Orval code injection in zod schema generation via unescaped template literals](https://junglewise.ai/threats/cve-2026-71869-orval-code-injection-in-zod-schema-generation-via-template)
- [Orval zod code injection via unescaped template literal in default values](https://junglewise.ai/threats/cve-2026-71868-orval-template-literal-injection-in-zod-schema-defaults)
- [Orval RCE via property name injection in MSW mock generator](https://junglewise.ai/threats/cve-2026-71867-orval-rce-via-schema-property-name-computed-property-key)