CVE-2026-71867: Orval TypeScript Generator RCE Vulnerability

CVE-2026-71867 Overview

Orval is a code generator that produces type-safe JavaScript and TypeScript clients from OpenAPI v3 and Swagger v2 specifications. Versions prior to 8.21.0 fail to safely encode single quotes in schema property names when emitting object keys inside generated Mock Service Worker (MSW) mock factories. An attacker who controls an OpenAPI specification can inject arbitrary JavaScript that executes when the generated mock factory is invoked by tests or an MSW handler. The affected code lives in the getKey function in packages/core/src/getters/keys.ts and in the MSW mock generation logic. This flaw is classified under [CWE-89] and is fixed in Orval 8.21.0.

Critical Impact
Attacker-controlled OpenAPI specifications can achieve arbitrary code execution in developer workstations, CI runners, test environments, and application processes that load the generated mocks.

Affected Products

Orval (all versions prior to 8.21.0)
Projects consuming generated MSW mock factories produced by vulnerable Orval releases
CI/CD pipelines that run Orval-generated tests against untrusted OpenAPI or Swagger specifications

Discovery Timeline

2026-08-19 - CVE-2026-71867 published to NVD
2026-08-19 - Orval 8.21.0 released with the fix
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-71867

Vulnerability Analysis

Orval generates MSW mock factories that model API responses as JavaScript objects. Property names from the source OpenAPI schema are embedded directly into the generated code as single-quoted object keys. The getKey helper decides whether a property name is a valid ECMAScript identifier and, if not, wraps it in single quotes without escaping the string. A property name containing an unescaped single quote breaks out of the string literal and becomes part of the emitted TypeScript source. When the generated factory module is later imported by a test suite or an MSW handler, the injected code runs in the process that loaded it.

Root Cause

The root cause is missing string-literal escaping in the code generation path. The pre-patch implementation of getKey returned `'${key}'` for non-identifier keys, treating the schema value as trusted output rather than untrusted input. Because Orval trusts specification content and writes it verbatim into .ts files, any adversary who can influence a schema property name controls the emitted JavaScript.

Attack Vector

An attacker supplies a malicious OpenAPI or Swagger document, for example through a shared API registry, a pull request that modifies a spec file, or a remote $ref. Running Orval against that document produces mock factories containing the attacker's payload. Execution occurs the moment those factories are evaluated in the developer, continuous integration, test, or runtime environment.

typescript

 import { keyword } from 'esutils';
 
+import { jsStringLiteralEscape } from '../utils';
+
 export function getKey(key: string) {
-  return keyword.isIdentifierNameES5(key) ? key : `'${key}'`;
+  return keyword.isIdentifierNameES5(key)
+    ? key
+    : `'${jsStringLiteralEscape(key)}'`;
 }

Source: Orval commit 8ef1bfd

The patch routes non-identifier keys through jsStringLiteralEscape, which properly encodes single quotes and other spec-controlled characters before they reach the generated source.

Detection Methods for CVE-2026-71867

Indicators of Compromise

Generated MSW mock factory files that contain unbalanced or suspicious single quotes inside object keys.
OpenAPI or Swagger schema property names containing single quotes, backslashes, template literal syntax, or JavaScript keywords such as require, process, or child_process.
Unexpected outbound network connections or file writes originating from Node.js processes running Jest, Vitest, or MSW handlers during test execution.

Detection Strategies

Grep repositories for orval in package.json and confirm the resolved version is >= 8.21.0 in lockfiles.
Statically scan generated mock files for property keys that contain unescaped quotes or control characters.
Perform lint or AST review of Orval output before committing generated code to source control.

Monitoring Recommendations

Monitor CI/CD runners for anomalous process spawns, DNS lookups, or credential access during npm test or orval invocations.
Alert on modifications to OpenAPI specification files followed by regeneration of client and mock code in the same pipeline run.
Track EDR telemetry for Node.js child processes launched from test runners in developer workstations.

How to Mitigate CVE-2026-71867

Immediate Actions Required

Upgrade Orval to version 8.21.0 or later across every repository and CI image.
Regenerate all MSW mock factories after upgrading so previously emitted vulnerable code is replaced.
Audit recent changes to OpenAPI and Swagger specifications for suspicious property names introduced by external contributors.

Patch Information

The fix is available in Orval 8.21.0. It adds a jsesc-based helper (jsStringLiteralEscape) and applies it in getKey and related MSW mock generation paths. See the GitHub Security Advisory GHSA-2w86-xfrc-g85r, pull request #3692, and release v8.21.0 for full details.

Workarounds

Restrict Orval execution to trusted OpenAPI or Swagger inputs and reject specifications from untrusted sources.
Run code generation inside sandboxed CI jobs with no secrets, no network egress, and a read-only workspace.
Manually review generated MSW mock files for injected JavaScript before merging them.

bash

# Upgrade Orval and regenerate clients
npm install --save-dev orval@^8.21.0
npx orval --clean
npm test