CVE-2026-71869: Orval TypeScript Client Generator RCE Flaw

CVE-2026-71869 Overview

CVE-2026-71869 is a code injection vulnerability in Orval, a tool that generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. The flaw resides in the formatDefaultValue function within packages/zod/src/index.ts. When an OpenAPI specification includes an array item with a default value containing a ${...} expression or backtick, Orval emits the value directly into a module-level template literal without safe encoding. Importing the generated Zod schema module executes attacker-controlled JavaScript in developer, continuous integration, test, or application environments. The issue is fixed in version 8.21.0.

Critical Impact
A malicious OpenAPI specification can achieve arbitrary code execution against any workstation, pipeline, or runtime that imports the generated Zod schema module.

Affected Products

Orval versions prior to 8.21.0
@orval/zod package (Zod schema generator)
Downstream projects consuming Orval-generated Zod modules

Discovery Timeline

2026-08-19 - CVE-2026-71869 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-71869

Vulnerability Analysis

Orval reads OpenAPI or Swagger specifications and generates TypeScript client code, including Zod validation schemas. The formatDefaultValue function in packages/zod/src/index.ts handles default values for array items and interpolates them into a generated template literal. Because the function did not escape template literal metacharacters, any ${...} interpolation or backtick present in a specification default value is preserved verbatim in the generated JavaScript module.

When a developer, CI runner, test suite, or deployed application imports the generated module, the JavaScript engine evaluates the interpolated expression. This yields full code execution in the process performing the import, with the privileges of the user or service account running the build or application. The weakness is classified as Improper Control of Generation of Code [CWE-94].

Root Cause

The generator treated specification-supplied strings as trusted content when emitting them into template literals and object keys. Zod schema output such as `${defaultValue}` embeds the raw specification default, so a payload like ${process.mainModule.require('child_process').execSync('id')} executes at import time. The 8.21.0 patch introduces a jsStringLiteralEscape utility and applies it to spec-controlled strings before they are placed inside template literals or object key expressions.

Attack Vector

Exploitation requires only that a victim run Orval against an attacker-influenced OpenAPI or Swagger document. Common attack paths include a malicious upstream API definition consumed by a client project, a pull request that modifies a checked-in specification, or a compromised specification registry. No authentication or user interaction is required beyond the standard client-generation workflow.

typescript

// Patch excerpt from packages/core/src/getters/keys.ts
 import { keyword } from 'esutils';

+import { jsStringLiteralEscape } from '../utils';
+
 export function getKey(key: string) {
-  return keyword.isIdentifierNameES5(key) ? key : `'${key}'`;
+  return keyword.isIdentifierNameES5(key)
+    ? key
+    : `'${jsStringLiteralEscape(key)}'`;
 }

Source: GitHub Commit 8ef1bfd

Detection Methods for CVE-2026-71869

Indicators of Compromise

Generated Zod schema modules containing unescaped ${...} interpolations or backticks originating from specification defaults.
Unexpected child process spawns (node, sh, bash, powershell) from CI runners or developer workstations during orval execution or module import.
Outbound network connections initiated by build agents immediately after Zod schema generation or import.

Detection Strategies

Diff generated Orval output against the source specification and flag any template literal expressions that were not present in the input schema literal defaults.
Scan repositories for Orval versions less than 8.21.0 in package.json, package-lock.json, pnpm-lock.yaml, yarn.lock, and bun.lock.
Perform static analysis on generated *.zod.ts files for ${ or backtick sequences inside default-value assignments.

Monitoring Recommendations

Alert on process creation events where node invokes child_process, exec, or shell binaries during dependency install or code generation phases.
Monitor CI job logs for anomalous stdout that indicates payload execution, such as reconnaissance commands issued at import time.
Track outbound egress from build infrastructure to non-approved destinations shortly after schema generation.

How to Mitigate CVE-2026-71869

Immediate Actions Required

Upgrade Orval and all @orval/* packages to version 8.21.0 or later across every project and CI configuration.
Regenerate any previously produced Zod schema modules from trusted specifications and replace the artifacts committed to source control.
Audit OpenAPI and Swagger specification sources for ${ sequences or backticks inside array item default values.

Patch Information

The fix is available in Orval release v8.21.0 and documented in GHSA-2h9g-j24r-h63g. The change set is in Pull Request #3692, which introduces jsStringLiteralEscape and applies it in the Zod generator and key generator paths.

Workarounds

Restrict Orval execution to specifications from verified, signed sources until the upgrade is completed.
Run code generation inside an ephemeral, network-restricted container without access to secrets or production credentials.
Add a pre-commit check that rejects generated files containing template literal interpolations not derived from safe primitives.

bash

# Pin Orval to a patched release across a workspace
npm install --save-dev orval@^8.21.0
npm ls orval @orval/zod @orval/core

# Fail the build if a vulnerable version remains resolved
npx --yes npm-audit-resolver || true
node -e "const v=require('orval/package.json').version; if (require('semver').lt(v,'8.21.0')) { console.error('Vulnerable Orval version:',v); process.exit(1); }"