Listen to this Post
Orval is a build-time development tool that generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. The vulnerability resides in the zod schema generation module, specifically in the `formatDefaultValue` function within packages/zod/src/index.ts.
When Orval processes an OpenAPI specification containing an enum-typed property with a default value, it emits that default as a module-level template literal in the generated Zod schema code—for example, export const …Default = \v${. The critical flaw is that Orval fails to escape `${` (the template literal interpolation delimiter) and backticks before embedding the default value into the generated code.v${globalThis.ORVPWN()}w`, the `${…}` expression is injected directly into the template literal. When the generated Zod schema module is imported by any application—whether during development, in a CI pipeline, or in a production environment—the JavaScript expression inside `${…}` executes immediately at import time. No HTTP request, no function call, and no user interaction is required.
If an attacker crafts an OpenAPI specification with a malicious default value such as
This vulnerability survives default OpenAPI validation because the malicious payload is treated as a legitimate string value by the validator. The attack vector is particularly dangerous because Orval is commonly used in build processes and CI/CD pipelines. An attacker could host a malicious OpenAPI specification on a public registry or compromise a dependency; when a victim generates and imports the Zod schema module, the attacker’s code executes with the privileges of the importing environment.
The vulnerability affects all Orval versions prior to 8.21.0. The issue has been assigned CVE-2026-71868 and is classified under CWE-94 (Improper Control of Generation of Code), CWE-116 (Improper Encoding or Escaping of Output), and CWE-1336 (Improper Neutralization of Special Elements Used in a Template Engine).
DailyCVE Form:
Platform: orval-labs/orval
Version: < 8.21.0
Vulnerability: Import-time RCE
Severity: Critical (CVSS 9.3)
date: 2026-08-19
Prediction: Patch already released (8.21.0)
What Undercode Say:
Check installed Orval version
npm list orval
Generate Zod schema from malicious OpenAPI spec
npx orval --input malicious-openapi.yaml --output ./generated
When the generated module is imported, code executes
node -e "require('./generated/zod-schema')"
Exploit: (Educational Purposes!)
malicious-openapi.yaml (excerpt)
openapi: 3.0.0
components:
schemas:
MaliciousEnum:
type: string
enum:
- safe_value
default: "v${globalThis.ORVPWN()}w"
// Generated Zod schema (vulnerable output)
export const MaliciousEnumDefault = <code>v${globalThis.ORVPWN()}w</code>;
// ${globalThis.ORVPWN()} executes at import
reproduce.sh - generates and imports the malicious schema
!/bin/bash
npx orval --input make_spec.py --output ./output
node -e "require('./output/zod-schema')" triggers RCE
Protection:
- Upgrade Orval to version 8.21.0 or later immediately
- If immediate upgrade is not possible, avoid processing OpenAPI specifications containing default values with `${…}` or backticks
- Sanitize or validate all third-party OpenAPI specifications before passing them to Orval
- Run Orval in isolated or sandboxed environments when processing untrusted specifications
- Audit existing CI/CD pipelines and development environments for any generated code that may have originated from untrusted API specifications
Impact:
Remote Code Execution (RCE) at import time in any application that imports a Zod schema module generated from an attacker-controlled or attacker-influenced OpenAPI description. The attack requires no authentication, no user interaction, and no special privileges. Since Orval is a development/build-time tool, this vulnerability can compromise developer workstations, CI/CD runners, and build environments—potentially leading to credential theft, source code exfiltration, supply chain attacks, and lateral movement within internal networks. The CVSS v4.0 base score is 9.3 (Critical).
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
