CVE-2026-71866: Orval TypeScript Client RCE Vulnerability

CVE-2026-71866 Overview

CVE-2026-71866 is a code injection vulnerability in Orval, a tool that generates type-safe JavaScript and TypeScript clients from OpenAPI v3 and Swagger v2 specifications. Versions from 8.19.0 up to (but not including) 8.21.0 emit unescaped double quotes from schema property names directly into generated zod.object({...}) schemas. An attacker who controls an OpenAPI or Swagger specification can inject arbitrary JavaScript into the generated Zod module. The injected code executes when the module is imported into a developer workstation, CI pipeline, test runner, or production application. The issue was fixed in version 8.21.0.

Critical Impact
Attacker-controlled OpenAPI specifications trigger arbitrary code execution in developer, CI, test, and application environments that import Orval-generated Zod schemas.

Affected Products

Orval versions 8.19.0 through 8.20.x
The packages/zod/src/index.ts module and Zod object-key generation logic
Downstream CI, build, and application environments consuming generated schemas

Discovery Timeline

2026-08-19 - CVE-2026-71866 published to the National Vulnerability Database (NVD)
2026-08-19 - Last updated in NVD database
Version 8.21.0 - Orval releases patched version with escaped object keys

Technical Details for CVE-2026-71866

Vulnerability Analysis

Orval consumes an OpenAPI or Swagger document and emits TypeScript source that constructs Zod validators. During generation, property names from the specification are inserted directly into an object({...}) literal wrapped in single quotes. The code did not escape characters that terminate the JavaScript string literal, allowing a crafted property name containing a single quote and JavaScript payload to break out of the string context. When a developer, build system, or application imports the generated module, the injected payload executes with the privileges of that process. The weakness is classified under CWE-89-adjacent injection semantics but functions as JavaScript code injection into generated source.

Root Cause

The getKey function in packages/core/src/getters/keys.ts returned a raw identifier when the key was a valid ES5 identifier and otherwise wrapped the key in single quotes without escaping. Property names carrying quote characters, backslashes, or newlines terminate the string literal early and inject executable code into the generated module.

Attack Vector

An attacker supplies a malicious OpenAPI or Swagger specification whose schema property name contains JavaScript control characters. When Orval generates client code from that specification, the payload is written into the Zod schema file. Any subsequent import of that file evaluates the payload. The attack requires no authentication, no user interaction beyond the standard code-generation workflow, and executes over the network via the supplied specification.

typescript

// Fix in packages/core/src/getters/keys.ts
 import { keyword } from 'esutils';
 
+import { jsStringLiteralEscape } from '../utils';
+
 export function getKey(key: string) {
-  return keyword.isIdentifierNameES5(key) ? key : `'${key}'`;
+  return keyword.isIdentifierNameES5(key)
+    ? key
+    : `'${jsStringLiteralEscape(key)}'`;
 }
// Source: https://github.com/orval-labs/orval/commit/8ef1bfdf3f9bcaf9dabfbe2e42887f1c0e159ab6

Detection Methods for CVE-2026-71866

Indicators of Compromise

Generated Zod schema files containing unexpected JavaScript expressions inside z.object({ ... }) keys.
Unexplained outbound network connections from CI runners or developer workstations immediately after running orval code generation.
Modifications to node_modules, environment files, or credentials on machines that imported Orval-generated modules.

Detection Strategies

Grep generated schema files for suspicious characters in object keys, such as unescaped quotes, backticks, or ${ sequences.
Diff Orval output against known-good baselines in code review and reject changes that introduce non-string tokens between object keys.
Track the Orval package version across repositories and flag any pinned range covering 8.19.0 through 8.20.x.

Monitoring Recommendations

Monitor process telemetry on build agents for child processes spawned by node, tsx, or vitest shortly after schema imports.
Alert on new outbound connections from CI containers to domains not on an allow list.
Log and review OpenAPI or Swagger specifications ingested from third parties, especially those fetched from remote URLs at build time.

How to Mitigate CVE-2026-71866

Immediate Actions Required

Upgrade Orval to version 8.21.0 or later in every repository and CI pipeline.
Regenerate all Zod schemas produced by affected versions and review the diff before committing.
Rotate any secrets that were present on machines that generated or imported schemas from untrusted OpenAPI sources.

Patch Information

The fix is available in Orval 8.21.0. See the GitHub Security Advisory GHSA-6mr6-jvcr-2f25, the pull request #3692, and the 8.21.0 release notes. The patch introduces jsStringLiteralEscape (backed by jsesc) so property names are safely encoded before insertion into generated template literals and object keys.

Workarounds

Restrict Orval code generation to OpenAPI or Swagger specifications from trusted sources only.
Run Orval inside an ephemeral, network-restricted container so any injected payload cannot exfiltrate data or persist.
Manually audit generated Zod modules for injection artifacts before importing them into build or runtime environments.

bash

# Upgrade Orval to the patched release
npm install --save-dev orval@^8.21.0

# Verify installed version
npm ls orval

# Regenerate schemas and review the diff
npx orval
git diff -- '*/zod/*.ts'