CVE-2026-72717: Orval zod schema code injection via unescaped default value

CVE-2026-72717 · Severity: critical · CVSS 4 · Published 2026-08-19

Orval is a popular code generator that creates TypeScript validation schemas from OpenAPI specifications. The tool contains a critical flaw where it fails to properly escape default values when generating zod validation modules, allowing an attacker who controls or influences an OpenAPI schema to inject and execute arbitrary JavaScript code when the generated schema is imported into an application. This gives attackers complete system access the moment a developer's build process imports the compromised schema—no user interaction or API request required.

Technologies: orval (npm). Vendors: npm.

Quick answers

Is CVE-2026-72717 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-72717 being exploited in the wild.
How severe is CVE-2026-72717?
Critical severity, with a CVSS score of 4, published 19 August 2026.
Which products and versions are affected?
orval (npm) < 8.21.0, SEMVER:introduced=0,fixed=8.21.0.
Is there a fix for CVE-2026-72717?
Yes. orval (npm): upgrade to 8.21.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-72717 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-72717?
Check whether you run orval (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • orval (npm): upgrade to 8.21.0 or later
    npm install orval@8.21.0

Technical details

The vulnerability is a code injection flaw (CWE-94, CWE-116, CWE-1336) in Orval's zod schema generation. Default values are emitted as backtick-quoted template literals (e.g., `export const getIResponseDsDefault = \`<default>\`;`) without escaping `${` or backticks. An attacker-supplied default value of the form `v${globalThis.ORVPWN()}w` injects a live JavaScript expression that is evaluated at module import time, not at runtime or on function call. While Orval properly escapes other value sinks (enum, mock, regex, object defaults) using `\'` in single-quoted strings, the `default` field is uniquely emitted as a template literal, making it the only unescaped injection point. The attack requires either an attacker-controlled OpenAPI schema or influence over a schema used by the target application (e.g., via supply-chain compromise). No authentication, privileges, or user interaction are required. The fix is to encode default values using JSON.stringify or to escape backticks and `${` sequences if template literals are used.

Affected products

  • orval-labs orval < 8.21.0

Identifiers

  • CVE-2026-72717
  • GHSA-w727-8j6c-2rj4

Timeline

  • 2026-09-03: disclosed: Published by GitHub Advisory Database
  • 2026-09-03: patched: Version 8.21.0 released with fix
  • 2026-07-12: advisory: Published to repository advisory
  • 2026-08-19: other: Published to National Vulnerability Database

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.