CVE-2026-71864: Orval TypeScript Generator RCE Vulnerability

CVE-2026-71864 Overview

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. A code injection vulnerability affects Orval versions prior to 8.21.0. The flaw resides in packages/zod/src/index.ts and impacts header request-validation generation. A double quote character embedded in a header parameter name is emitted directly into the generated zod.object({...}) schema without safe encoding. This permits attacker-controlled JavaScript to execute when the generated Zod schema module is imported. Execution occurs in developer workstations, continuous integration pipelines, test runners, or downstream application environments. The vulnerability is tracked as CWE-94 (Improper Control of Generation of Code).

Critical Impact
A malicious OpenAPI or Swagger specification can achieve arbitrary code execution across developer, CI, and application environments during code generation and import.

Affected Products

Orval versions prior to 8.21.0
packages/zod/src/index.ts header request-validation generator
Any Node.js project consuming Orval-generated Zod schemas from untrusted OpenAPI specifications

Discovery Timeline

2026-08-19 - CVE-2026-71864 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-71864

Vulnerability Analysis

Orval consumes an OpenAPI or Swagger specification and produces TypeScript client code, including Zod validation schemas. When generating validation for HTTP header parameters, the tool builds object literals whose keys are drawn directly from the specification. The generator wraps non-identifier keys in single quotes without escaping embedded quote characters. An attacker who controls the specification can insert a double quote (or terminating single quote) inside a header name and break out of the string literal. The injected content lands inside a JavaScript source file that is later imported by the consuming project. Import evaluates top-level expressions, so the injected code runs immediately in whatever process loads the module.

Root Cause

The root cause is missing string-literal escaping in the object-key emitter. Prior to the fix, getKey returned `'${key}'` for non-identifier keys, trusting the raw specification string. The patched implementation routes the key through a dedicated jsStringLiteralEscape helper backed by the jsesc library. This ensures quotes, backslashes, and newlines are neutralized before insertion into the generated source.

Attack Vector

Exploitation requires an Orval user to run code generation against a specification supplied by an attacker. Common vectors include importing a third-party OpenAPI document, consuming a specification from an untrusted registry, or fetching a schema over the network. No authentication or user interaction beyond running the generator or importing the output is required. The resulting code executes with the privileges of the developer, CI job, or application process.

typescript

// Patched code from packages/core/src/getters/keys.ts
import { keyword } from 'esutils';

import { jsStringLiteralEscape } from '../utils';

export function getKey(key: string) {
  return keyword.isIdentifierNameES5(key)
    ? key
    : `'${jsStringLiteralEscape(key)}'`;
}

Source: Orval commit 8ef1bfd

Detection Methods for CVE-2026-71864

Indicators of Compromise

Generated Zod schema files containing unbalanced quotes, unexpected function calls, or require/import statements inside object key positions
OpenAPI or Swagger specifications where header parameters[].name contains ", ', \, or newline characters
Unexpected child processes spawned by node, tsx, vitest, or jest immediately after running orval or importing generated modules

Detection Strategies

Diff generated Zod schema output against previous builds to surface newly injected identifiers or expressions in header object keys
Run static analysis or lint rules on generated code that flag non-string tokens inside z.object({...}) key positions
Validate every OpenAPI specification with a schema linter that rejects non-printable and quote characters in parameter names

Monitoring Recommendations

Monitor CI runners for outbound network connections initiated during orval invocations or dependency install steps
Log the SHA-256 of every OpenAPI specification consumed by build pipelines and alert on unreviewed changes
Track developer workstation process trees for shells or interpreters spawned by editor language servers loading generated modules

How to Mitigate CVE-2026-71864

Immediate Actions Required

Upgrade Orval to version 8.21.0 or later across all developer, CI, and build environments
Regenerate all Zod schemas produced by prior Orval versions and review the diff for injected content
Restrict Orval execution to specifications sourced from trusted, version-controlled locations

Patch Information

The fix ships in Orval 8.21.0. The patch adds jsesc as a dependency and routes non-identifier object keys through jsStringLiteralEscape before emission. See the GitHub Security Advisory GHSA-6437-gxhq-pqv8, the pull request #3692, and the v8.21.0 release notes.

Workarounds

Pre-validate OpenAPI specifications and reject any header parameter name containing characters outside [A-Za-z0-9_-]
Execute orval inside an ephemeral sandbox or container with no network egress and no access to developer credentials
Treat generated client code as untrusted until reviewed, and gate merges on automated inspection of the emitted Zod schemas

bash

# Upgrade Orval to the patched release
npm install --save-dev orval@^8.21.0

# Verify the installed version
npx orval --version

# Regenerate clients after upgrade
npx orval --config ./orval.config.ts