CVE-2026-71868: Orval TypeScript Client RCE Vulnerability

CVE-2026-71868 Overview

CVE-2026-71868 is a code injection vulnerability [CWE-94] in Orval, a tool that generates type-safe JavaScript and TypeScript clients from OpenAPI v3 and Swagger v2 specifications. Versions prior to 8.21.0 fail to safely encode ${...} expressions and backticks inside enum default values. These characters flow directly into module-level template literals produced by the zod schema generator. When a developer, CI runner, or application imports the generated module, attacker-controlled JavaScript executes in that environment. The flaw resides in the formatDefaultValue function within packages/zod/src/index.ts. Version 8.21.0 fixes the issue by escaping spec-controlled strings before emission.

Critical Impact
A malicious OpenAPI or Swagger specification can achieve arbitrary code execution on developer workstations, CI/CD pipelines, and any environment that imports the generated zod schema module.

Affected Products

Orval versions prior to 8.21.0
The @orval/zod package (zod schema generator)
Any downstream project consuming generated zod schemas from vulnerable Orval builds

Discovery Timeline

2026-08-19 - CVE-2026-71868 published to NVD
2026-08-19 - Last updated in NVD database
v8.21.0 - Orval releases patched version with escaped template literals

Technical Details for CVE-2026-71868

Vulnerability Analysis

Orval reads OpenAPI or Swagger specifications and emits TypeScript source files containing zod schemas. Inside formatDefaultValue, enum default values are interpolated into a JavaScript template literal without sanitization. A specification author who controls an enum default can inject a ${payload} expression or a backtick that closes the surrounding literal. The resulting file is valid TypeScript that executes the injected expression at module load time.

Execution occurs whenever the generated module is imported. That includes the developer's editor tooling, tsc builds, unit test runs, CI pipelines, and any deployed application that consumes the schemas. The vulnerability turns a supply chain document, the API specification, into a code execution primitive.

Root Cause

The root cause is missing output encoding when constructing generated source code. formatDefaultValue concatenated raw specification strings into a JavaScript template literal context. Template literals evaluate ${...} expressions and can be closed by backticks, so any specification value containing these characters becomes executable code rather than data.

Attack Vector

An attacker publishes or contributes an OpenAPI or Swagger document containing a crafted enum default value. When a victim runs Orval against the specification, the generator writes an executable payload into the zod schema module. Importing that module executes the payload with the privileges of the current process.

typescript

// Patch excerpt from packages/core/src/getters/keys.ts
 import { keyword } from 'esutils';
 
+import { jsStringLiteralEscape } from '../utils';
+
 export function getKey(key: string) {
-  return keyword.isIdentifierNameES5(key) ? key : `'${key}'`;
+  return keyword.isIdentifierNameES5(key)
+    ? key
+    : `'${jsStringLiteralEscape(key)}'`;
 }
// Source: https://github.com/orval-labs/orval/commit/8ef1bfdf3f9bcaf9dabfbe2e42887f1c0e159ab6

The fix routes untrusted strings through jsStringLiteralEscape, which neutralizes backticks, dollar-brace sequences, and other characters that break out of a literal context. The lockfile change adds jsesc as a dependency to support this escaping.

Detection Methods for CVE-2026-71868

Indicators of Compromise

Generated zod schema files containing unexpected ${ expressions or unmatched backticks inside default value literals
Outbound network connections initiated by node, tsc, jest, or CI runner processes during code generation or test phases
Unexpected child processes spawned by orval or by build tooling that imports Orval-generated modules
OpenAPI or Swagger specifications sourced from external repositories containing backticks or ${...} in enum defaults

Detection Strategies

Scan Orval-generated output directories for template literals containing unescaped ${ or backtick characters inside default value assignments
Audit lockfiles for orval versions below 8.21.0 across all repositories
Diff generated schema files against a known-clean baseline after each specification update
Review OpenAPI specification enum defaults for characters that have no legitimate reason to appear

Monitoring Recommendations

Log and alert on network egress from build agents and developer workstations during orval execution
Monitor CI pipeline processes for unexpected shell, download, or credential-access activity during dependency install and code generation stages
Track file writes by the Orval process to detect writes outside expected output paths

How to Mitigate CVE-2026-71868

Immediate Actions Required

Upgrade Orval to version 8.21.0 or later in all projects, including nested workspaces and monorepo packages
Regenerate all zod schema modules from trusted specifications after upgrading and diff against previous output
Rotate credentials that were reachable from any environment that ran a vulnerable Orval version against an untrusted specification
Treat externally sourced OpenAPI and Swagger documents as untrusted input in threat models

Patch Information

The fix is included in Orval v8.21.0. The change is tracked in Pull Request #3692 and commit 8ef1bfd. Full details are published in GitHub Security Advisory GHSA-3575-w9fc-c2j6.

Workarounds

Pre-process specifications to strip or reject backticks and ${ sequences from enum default values before running Orval
Run Orval inside an isolated container or sandbox with no network access and no access to production credentials
Restrict generated code imports to CI stages where secrets are not present until the upgrade is applied

bash

# Upgrade Orval to the patched release
npm install --save-dev orval@^8.21.0

# Verify installed version
npx orval --version

# Regenerate schemas from a trusted specification and inspect output
npx orval --config ./orval.config.ts
grep -RIn --color '\${\|`' ./src/generated || echo 'no suspicious literals found'