CVE-2026-71871: Orval TypeScript Client Generator RCE Flaw

CVE-2026-71871 Overview

CVE-2026-71871 is a code injection vulnerability in Orval, a tool that generates type-safe JavaScript and TypeScript clients from OpenAPI v3 and Swagger v2 specifications. Versions prior to 8.21.0 fail to safely encode ${...} expressions and backtick characters when emitting header parameter defaults into module-level template literals during zod schema generation. Attacker-controlled JavaScript embedded in an OpenAPI specification executes when the generated zod module is imported. The vulnerable logic lives in the formatDefaultValue function inside packages/zod/src/index.ts. This flaw is tracked as CWE-94: Improper Control of Generation of Code.

Critical Impact
Importing a generated zod schema built from a malicious OpenAPI specification results in arbitrary JavaScript execution inside developer workstations, CI runners, test harnesses, or application runtimes.

Affected Products

Orval versions prior to 8.21.0
Generated zod schema modules produced by affected Orval releases
Downstream applications, CI/CD pipelines, and developer environments importing those modules

Discovery Timeline

2026-08-19 - CVE-2026-71871 published to the National Vulnerability Database
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-71871

Vulnerability Analysis

Orval reads OpenAPI or Swagger specifications and generates client code, including zod validation schemas. When a header parameter defines a default value, Orval writes that string into a JavaScript template literal at the top level of the generated module. The formatDefaultValue helper in packages/zod/src/index.ts inserts the raw value without escaping template-literal metacharacters. A specification author who controls the header default can inject ${payload} or backtick sequences that the JavaScript engine evaluates at module load. Because zod schema modules are typically imported at application startup, the payload runs before any request handling occurs.

Root Cause

The root cause is unsafe interpolation of spec-controlled strings into generated template literals. The generator concatenated user-supplied text into backtick-delimited strings without escaping `, \, or ${. The fix introduces a jsStringLiteralEscape utility and applies jsesc to any spec-derived value before it reaches the emitted source.

Attack Vector

An attacker supplies a crafted OpenAPI or Swagger specification, either by publishing it, contributing it to a shared repository, or compromising an upstream API definition. When a developer or CI job runs Orval against the specification, the malicious ${...} payload is baked into the generated zod module. Any subsequent import of that module executes the payload with the privileges of the host process.

typescript

// Patch excerpt: packages/core/src/getters/keys.ts
 import { keyword } from 'esutils';

+import { jsStringLiteralEscape } from '../utils';
+
 export function getKey(key: string) {
-  return keyword.isIdentifierNameES5(key) ? key : `'${key}'`;
+  return keyword.isIdentifierNameES5(key)
+    ? key
+    : `'${jsStringLiteralEscape(key)}'`;
 }

Source: orval-labs/orval commit 8ef1bfd. The patch wraps spec-controlled identifiers with jsStringLiteralEscape so template literals and object keys can no longer break out of their string context.

Detection Methods for CVE-2026-71871

Indicators of Compromise

Generated zod schema files containing unescaped backticks or ${...} sequences inside module-level template literals.
OpenAPI specifications where header parameter default values include backticks, ${, or JavaScript identifiers such as process, require, or globalThis.
Unexpected outbound network connections, child processes, or file writes originating from node processes that import Orval-generated modules.

Detection Strategies

Perform static analysis on generated client output for template-literal expressions that reference JavaScript globals rather than expected constants.
Diff generated artifacts against the source specification to confirm no executable JavaScript was introduced by string defaults.
Inventory package manifests and lockfiles for orval versions below 8.21.0 across developer workstations and CI images.

Monitoring Recommendations

Alert on process trees where CI build steps or node module loads spawn shells, package managers, or credential-access tooling.
Monitor version control for OpenAPI files whose parameter defaults contain shell metacharacters or JavaScript template syntax.
Log and review dependency changes that introduce or update the orval package in application repositories.

How to Mitigate CVE-2026-71871

Immediate Actions Required

Upgrade Orval to version 8.21.0 or later across all developer, CI, and build environments.
Regenerate every zod schema and client module previously produced by an affected Orval version.
Audit OpenAPI and Swagger specifications for header parameter defaults containing backticks or ${ sequences and remove them.
Rotate secrets accessible to CI runners or developer machines that recently executed Orval against untrusted specifications.

Patch Information

The fix ships in Orval v8.21.0 via pull request #3692 and commit 8ef1bfd. Full advisory details are published as GHSA-8j6p-r8jg-mxqh. The patch adds jsesc and a jsStringLiteralEscape helper that encodes spec-controlled strings before emission into template literals and object keys.

Workarounds

Restrict Orval execution to OpenAPI specifications from trusted, code-reviewed sources until the upgrade is complete.
Run code generation inside an ephemeral, network-restricted container without access to production credentials or signing keys.
Manually inspect generated zod modules for template-literal interpolations before committing them to source control.

bash

# Upgrade Orval to the patched release
npm install --save-dev orval@^8.21.0

# Verify the installed version
npx orval --version

# Regenerate clients from a trusted specification
npx orval --config ./orval.config.ts