CVE-2026-71865: Orval TypeScript Client RCE Vulnerability

CVE-2026-71865 Overview

CVE-2026-71865 is a code injection vulnerability [CWE-94] in Orval, a code generator that produces type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Versions prior to 8.21.0 emit a double quote inside a query parameter name directly into the generated zod.object({...}) request-validation schema without safe encoding. An attacker who controls the OpenAPI or Swagger specification can inject arbitrary JavaScript that executes when the generated module is imported. Execution occurs in the developer workstation, CI runner, test harness, or downstream application process. The issue is fixed in version 8.21.0.

Critical Impact
Attacker-controlled specification content can achieve arbitrary code execution in developer, CI, test, and production environments the moment the generated zod schema module is imported.

Affected Products

Orval versions prior to 8.21.0
The @orval/zod package and consumers using zod request-validation generation
Downstream CI, test, and application environments that import Orval-generated modules

Discovery Timeline

2026-08-19 - CVE-2026-71865 published to NVD
2026-08-19 - Last updated in NVD database
Orval 8.21.0 released with the fix

Technical Details for CVE-2026-71865

Vulnerability Analysis

Orval reads an OpenAPI or Swagger specification and generates TypeScript source files containing zod schemas that validate request parameters. When a query parameter name contained a double quote character, the generator inserted the raw name inside a single-quoted JavaScript string literal used as an object key in zod.object({...}). The single-quoted literal did not escape embedded quotes or backslashes, allowing the parameter name to close the string prematurely and inject arbitrary JavaScript expressions into the emitted module. Because the injected content lives in a top-level module, it runs during import, before any application logic executes. The affected code path resides in packages/zod/src/index.ts and the query request-validation generation logic.

Root Cause

The generator built object keys by wrapping identifiers with single quotes but did not apply JavaScript string literal escaping to the interpolated value. Any specification-controlled string that contained ', ", \, or newline sequences could break out of the intended literal and become executable code in the generated file.

Attack Vector

An attacker supplies a malicious OpenAPI or Swagger specification, for example through a pull request to a repository, a compromised upstream schema, or a public API definition consumed by Orval. When a developer or CI job runs Orval and then imports the generated module, the injected payload executes with the privileges of that process.

typescript

// Security patch in packages/core/src/getters/keys.ts
 import { keyword } from 'esutils';
 
+import { jsStringLiteralEscape } from '../utils';
+
 export function getKey(key: string) {
-  return keyword.isIdentifierNameES5(key) ? key : `'${key}'`;
+  return keyword.isIdentifierNameES5(key)
+    ? key
+    : `'${jsStringLiteralEscape(key)}'`;
 }
// Source: https://github.com/orval-labs/orval/commit/8ef1bfdf3f9bcaf9dabfbe2e42887f1c0e159ab6

The patch routes non-identifier keys through jsStringLiteralEscape, which safely encodes quotes, backslashes, and control characters before emission. The lockfile change adds jsesc as a dependency to support this escaping.

Detection Methods for CVE-2026-71865

Indicators of Compromise

Generated zod schema files that contain unexpected JavaScript statements between object keys or after string literals.
Unusual child processes spawned from node during orval runs, package installs, or test execution.
Outbound network connections initiated by CI jobs at the point of import rather than during test execution.
OpenAPI or Swagger specifications with parameter names containing ", \, or newline characters.

Detection Strategies

Diff generated client output against a known-good baseline and flag any tokens outside the expected zod.object({ 'name': z.string() }) shape.
Static-analysis rules that scan Orval output for characters such as '; , \n, or require( appearing inside key positions.
Dependency inventory checks that flag orval and @orval/zod versions below 8.21.0.

Monitoring Recommendations

Monitor CI build agents for process execution and outbound connections originating from Node.js module loads.
Alert on modifications to OpenAPI or Swagger source files that introduce quote characters in parameter names.
Track code-generation steps in build pipelines and record hashes of emitted files for later comparison.

How to Mitigate CVE-2026-71865

Immediate Actions Required

Upgrade Orval to version 8.21.0 or later across all developer workstations, CI runners, and build images.
Regenerate all zod schema modules with the patched version and replace previously generated artifacts.
Audit recent OpenAPI and Swagger specifications for parameter names containing double quotes, backslashes, or control characters.
Rotate any credentials that were accessible in CI or developer environments that ran vulnerable Orval builds against untrusted specs.

Patch Information

The fix is included in Orval 8.21.0. See the GitHub Security Advisory GHSA-653q-5476-x79g, the GitHub Release v8.21.0, the Pull Request Discussion, and the Commit Changes for full details.

Workarounds

Treat all OpenAPI and Swagger inputs as untrusted and validate parameter names against a strict allowlist such as ^[A-Za-z_][A-Za-z0-9_-]*$ before running Orval.
Run Orval generation in an isolated container with no credentials or network egress until upgrade is complete.
Manually review generated zod modules before importing them into applications or test suites.

bash

# Upgrade Orval to the patched release
npm install --save-dev orval@^8.21.0

# Verify installed version
npx orval --version

# Regenerate clients from a trusted specification
npx orval --config ./orval.config.ts