CVE-2026-72716: Orval TypeScript Client RCE Vulnerability

CVE-2026-72716 Overview

CVE-2026-72716 is a code injection vulnerability in Orval, a tool that generates type-safe TypeScript clients from OpenAPI v3 and Swagger v2 specifications. Versions prior to 8.21.0 fail to safely encode ${...} expressions and backticks when emitting query parameter defaults into module-level template literals during zod schema generation. An attacker who controls an OpenAPI specification can inject JavaScript that executes when the generated zod module is imported. Execution occurs in the developer workstation, continuous integration (CI) runner, test harness, or downstream application process. The flaw is tracked under CWE-1336 (Improper Neutralization of Special Elements Used in a Template Engine).

Critical Impact
Attacker-controlled OpenAPI specifications trigger arbitrary JavaScript execution in developer, CI, or application environments when generated zod modules are imported.

Affected Products

Orval versions prior to 8.21.0
The packages/zod code generator module
Any developer, CI, or runtime environment importing zod schemas generated from untrusted OpenAPI specifications

Discovery Timeline

2026-08-19 - CVE-2026-72716 published to NVD
2026-08-19 - Last updated in NVD database
Fixed in Orval 8.21.0 - Patch released via GitHub Release v8.21.0

Technical Details for CVE-2026-72716

Vulnerability Analysis

Orval reads OpenAPI or Swagger definitions and emits TypeScript source files that consumers import at build or runtime. The formatDefaultValue function in packages/zod/src/index.ts inserts query parameter default values directly into JavaScript template literals. Because template literals evaluate ${...} expressions, any specification-supplied string containing an expression becomes live code in the emitted module. Importing the generated file evaluates that expression under the importer's privileges.

Exploitation does not require an attacker to control the runtime target directly. A malicious OpenAPI file consumed by a build pipeline, a fork submitting a pull request that changes the schema, or a third-party API description can all deliver the payload. The result is code execution across every environment that regenerates or imports the schema.

Root Cause

The root cause is missing neutralization of template literal metacharacters when writing generator output. Query parameter defaults were interpolated as raw strings into backtick-quoted expressions, treating attacker-controlled content as trusted source code rather than data.

Attack Vector

The attack vector is network-adjacent through the software supply chain. An attacker publishes or modifies an OpenAPI specification containing a payload such as ${process.mainModule.require('child_process').execSync('...')} in a query parameter default. When a developer or CI job runs Orval against that specification and the resulting zod module is imported, the injected expression executes.

typescript

// Patch excerpt: escape identifier keys before emission
import { keyword } from 'esutils';

import { jsStringLiteralEscape } from '../utils';

export function getKey(key: string) {
  return keyword.isIdentifierNameES5(key)
    ? key
    : `'${jsStringLiteralEscape(key)}'`;
}
// Source: https://github.com/orval-labs/orval/commit/8ef1bfdf3f9bcaf9dabfbe2e42887f1c0e159ab6

The patch introduces jsStringLiteralEscape and adds the jsesc dependency to sanitize spec-controlled strings before they are written into generated template literals and object keys.

Detection Methods for CVE-2026-72716

Indicators of Compromise

Generated zod schema files containing unescaped ${ sequences or backticks inside default value strings
Unexpected child process spawns (node, sh, cmd.exe) originating from build tooling or test runners that import Orval output
Outbound network connections from CI runners immediately after orval code generation steps
Modifications to ~/.npmrc, SSH keys, or environment files coinciding with schema regeneration

Detection Strategies

Grep generated schema output for template literal interpolation patterns that did not exist in the source specification
Compare Orval-generated files against a clean baseline after each specification update
Inspect OpenAPI specifications for ${, backtick characters, or suspicious default values on query parameters before running the generator
Audit package.json and lockfiles for Orval versions below 8.21.0

Monitoring Recommendations

Log and alert on process ancestry where node spawns a shell inside CI pipelines
Monitor developer endpoints for anomalous outbound connections following npm run generate or equivalent Orval invocations
Track dependency inventory to flag any project still resolving Orval below 8.21.0

How to Mitigate CVE-2026-72716

Immediate Actions Required

Upgrade Orval to version 8.21.0 or later in all projects, including transitive usage
Rotate any secrets exposed to CI runners or developer machines that generated schemas from untrusted specifications
Review recent Orval-generated files for unexpected template literal expressions and regenerate them after upgrading
Restrict schema generation jobs to run against vetted, internally hosted OpenAPI specifications only

Patch Information

The fix ships in Orval 8.21.0. The change escapes spec-controlled strings before emission using the jsesc library. Reference materials:

Workarounds

Treat all third-party OpenAPI specifications as untrusted input and validate query parameter defaults for template literal metacharacters before running Orval
Run schema generation inside an ephemeral, network-isolated sandbox with no access to production credentials
Pin Orval to a known-good version in package.json and enforce lockfile integrity checks in CI

bash

# Upgrade Orval and refresh generated artifacts
npm install --save-dev orval@^8.21.0
npx orval --clean

# Verify installed version
npm ls orval