CVE-2026-72717: Orval TypeScript Client RCE Vulnerability

CVE-2026-72717 Overview

CVE-2026-72717 is a code injection vulnerability [CWE-94] in Orval, a tool that generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Versions prior to 8.21.0 emit ${...} expressions and backticks from schema default values directly into module-level template literals during Zod schema generation. The unsafe encoding permits attacker-controlled JavaScript to execute when the generated Zod schema module is imported. Execution occurs in developer workstations, continuous integration (CI) runners, test harnesses, or production application environments. The flawed logic resides in the formatDefaultValue function in packages/zod/src/index.ts.

Critical Impact
A malicious OpenAPI or Swagger specification can achieve arbitrary code execution across developer, CI, and application environments simply by being processed through Orval.

Affected Products

Orval (orval-labs/orval) versions prior to 8.21.0
packages/zod Zod schema generator within Orval
Downstream Node.js projects importing Orval-generated Zod modules

Discovery Timeline

2026-08-19 - CVE-2026-72717 published to the National Vulnerability Database (NVD)
2026-08-19 - Last updated in NVD database
Version 8.21.0 - Orval releases fixed version with escaped template literals

Technical Details for CVE-2026-72717

Vulnerability Analysis

Orval consumes OpenAPI and Swagger specifications and emits TypeScript source code, including Zod runtime validators. When a schema property carries a default value, Orval interpolates that value into a JavaScript template literal in the generated module. The formatDefaultValue function in packages/zod/src/index.ts does not escape backticks or ${...} expression delimiters before insertion. A crafted default such as `${process.mainModule.require('child_process').execSync('...')}` is treated as an active template expression when the module is loaded. Execution occurs at import time, not at request time, which broadens the blast radius to any process that requires the generated file.

Root Cause

The root cause is missing output encoding when serializing user-controlled string data into JavaScript source code. formatDefaultValue treats OpenAPI default values as trusted literals and concatenates them into backtick-delimited template strings. Because template literals evaluate embedded ${...} expressions, any specification author or upstream API description publisher can inject executable JavaScript into consuming projects.

Attack Vector

An attacker supplies or tampers with an OpenAPI or Swagger specification consumed by Orval. Common delivery paths include a compromised upstream API description hosted at a public URL, a pull request adding a malicious spec to a repository, or a supply chain attack on a schema registry. When developers or CI pipelines run Orval and then import the generated Zod module, the injected JavaScript executes with the privileges of that process. This can steal environment secrets, exfiltrate source code, plant persistence, or pivot into cloud infrastructure via CI credentials.

typescript

// Patch excerpt from packages/core/src/getters/keys.ts
 import { keyword } from 'esutils';
 
+import { jsStringLiteralEscape } from '../utils';
+
 export function getKey(key: string) {
-  return keyword.isIdentifierNameES5(key) ? key : `'${key}'`;
+  return keyword.isIdentifierNameES5(key)
+    ? key
+    : `'${jsStringLiteralEscape(key)}'`;
 }
// Source: https://github.com/orval-labs/orval/commit/8ef1bfdf3f9bcaf9dabfbe2e42887f1c0e159ab6

The fix introduces jsStringLiteralEscape and adds the jsesc dependency to safely encode spec-controlled strings before they are embedded in generated template literals and object keys.

Detection Methods for CVE-2026-72717

Indicators of Compromise

Generated Zod schema files containing unescaped backticks or ${ sequences originating from OpenAPI default fields.
Unexpected child_process, require, fetch, or net calls inside Orval-generated modules under src/zod/ or equivalent output paths.
CI job logs showing outbound network connections during orval generation or module import phases.
Environment variable access or secret enumeration triggered by importing a generated schema file.

Detection Strategies

Diff Orval-generated output against the source specification to flag any default value containing backticks, ${, or non-printable characters.
Run git grep -nE '\\$\\{|' path/to/generated/zod` against generated code and treat matches as high-severity findings.
Query package lockfiles across repositories for orval versions below 8.21.0 to enumerate exposed projects.

Monitoring Recommendations

Instrument CI runners to capture process trees during orval invocation and alert on child processes spawned by node importing generated schemas.
Log and review network egress from developer machines and build agents during schema generation and test execution.
Track OpenAPI specification sources and verify checksums or signatures before feeding them into code generation pipelines.

How to Mitigate CVE-2026-72717

Immediate Actions Required

Upgrade Orval to version 8.21.0 or later in every repository, container image, and CI pipeline.
Regenerate all Zod schemas produced by prior Orval versions and diff the output to identify prior injections.
Rotate secrets accessible to any developer workstation or CI runner that executed vulnerable Orval versions against untrusted specs.
Audit OpenAPI and Swagger inputs for default fields containing backticks or ${ sequences.

Patch Information

The fix is available in Orval 8.21.0. See the GitHub Security Advisory GHSA-w727-8j6c-2rj4, the remediation pull request #3692, the fix commit 8ef1bfd, and the v8.21.0 release notes. The patch adds the jsesc library and routes spec-controlled strings through jsStringLiteralEscape before emission.

Workarounds

Pin Orval to 8.21.0 or later via lockfile and enforce with Renovate or Dependabot policies.
Restrict Orval execution to specifications from trusted, signed sources and reject third-party specs pending review.
Run schema generation inside ephemeral, network-restricted sandboxes with no access to production secrets.
Add a pre-commit hook that fails when generated Zod modules contain unescaped template expression delimiters.

bash

# Upgrade Orval and verify the installed version
npm install --save-dev orval@^8.21.0
npx orval --version

# Locate any repositories still on vulnerable releases
find . -name package.json -exec grep -l '"orval"' {} \; \
  | xargs grep -E '"orval":\s*"\^?[0-7]\.|"orval":\s*"\^?8\.([0-9]|1[0-9]|20)\.'