DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-71869: CVE-2026-71869: Remote Code Execution in Orval via OpenAPI Default Value Template Literal Injection

#security #cve #cybersecurity

CVE-2026-71869: Remote Code Execution in Orval via OpenAPI Default Value Template Literal Injection

Vulnerability ID: CVE-2026-71869
CVSS Score: 9.3
Published: 2026-09-03

CVE-2026-71869 is a critical-severity code injection vulnerability in the Orval code generator (packages: orval, @orval/core, @orval/zod) prior to version 8.21.0. This flaw allows remote attackers to execute arbitrary JavaScript code at import-time by embedding malicious payloads into the default values of OpenAPI or Swagger specifications. This report details the root cause, exploitation mechanism, and patch remediation.

TL;DR

A critical vulnerability in Orval allows remote code execution at import-time via unescaped string default values in OpenAPI specifications during Zod schema generation.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-94, CWE-116, CWE-1336
  • Attack Vector: Network
  • CVSS Score: 9.3 (Critical)
  • EPSS Score: 0.00478
  • Impact: Remote Code Execution (RCE) at Import-Time
  • Exploit Status: Proof of Concept (PoC) documented
  • KEV Status: Not Listed

Affected Systems

  • Orval code generator (packages: orval, @orval/core, @orval/zod) versions < 8.21.0
  • orval: < 8.21.0 (Fixed in: 8.21.0)
  • @orval/core: < 8.21.0 (Fixed in: 8.21.0)
  • @orval/zod: < 8.21.0 (Fixed in: 8.21.0)

Code Analysis

Commit: 8ef1bfd

fix: prevent template-literal injection in zod generator schema defaults

Exploit Details

  • GitHub Issue/Test Suite: Exploit verification case embedded within the test suite using an executable JS payload as default value.

Mitigation Strategies

  • Upgrade all Orval packages to version 8.21.0 or higher.
  • Isolate and sandbox code generation environments.
  • Pre-audit and lint untrusted third-party OpenAPI specs.

Remediation Steps:

  1. Identify all projects containing orval, @orval/core, or @orval/zod in package.json.
  2. Run 'npm install orval@8.21.0 --save-dev' or the equivalent for yarn/pnpm.
  3. If running via Docker, update CLI references to ghcr.io/orval-labs/orval:8.21.0.
  4. Regenerate client assets and verify that output files contain properly escaped backticks and string variables.

References

Read the full report for CVE-2026-71869 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)