Listen to this Post
Orval is a tool that generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications.
The vulnerability (CVE-2026-71865) resides in Orval’s Zod client generation logic. Prior to version 8.21.0, the tool fails to properly escape or encode special characters, specifically double quotes ("), when embedding query parameter names into the generated Zod schema code.
When Orval processes an API definition containing a double quote within a query parameter name, it directly inserts this unsanitized string into the generated JavaScript code as a key within a `zod.object({…})` definition. An attacker can craft a query parameter name like "a":zod.string(),[require("fs").writeFileSync("PWNED","")]:zod.string().
This malicious input breaks out of the intended string key context and injects a computed property key (
</code>) into the object literal. The injected `[bash]` is a piece of arbitrary JavaScript that is evaluated when the Zod schema is defined.
Critically, this schema definition occurs at module import time; the line `export const OpQueryParams = zod.object({...})` executes as soon as the generated module is loaded. This means the attacker's code runs upon import, resulting in Remote Code Execution (RCE) during the build or development process. The attack vector is indirect, requiring an attacker to control the OpenAPI specification used by Orval. This vulnerability is distinct from other Orval findings related to <code>$ref</code>, route paths, server URLs, or Zod defaults.
<h2 style="color: blue;">The issue is fixed in Orval version 8.21.0.</h2>
<h2 style="color: blue;">DailyCVE Form:</h2>
Platform: orval (npm)
Version: < 8.21.0
Vulnerability: Import-time RCE
Severity: Critical (CVSS 9.3)
date: 2026-08-19
<h2 style="color: blue;">Prediction: Patched (8.21.0)</h2>
<h2 style="color: blue;">What Undercode Say:</h2>
Analytics show that the vulnerability is triggered by unsanitized query parameter names in the OpenAPI spec.
[bash]
Reproduce the issue (conceptual)
1. Create a malicious OpenAPI spec with a query parameter named:
"a":zod.string(),[require("fs").writeFileSync("PWNED","")]:zod.string()
2. Generate the Zod client using orval 8.19.0
3. Import the generated module
4. Observe that the file "PWNED" is created, indicating code execution
The core issue is in the code generation logic for Zod schemas, specifically in packages/zod/src/index.ts.
Exploit: (Educational Purposes!)
An attacker can control the query parameter name in an OpenAPI specification. An example payload is:
"a":zod.string(),[require("fs").writeFileSync("PWNED","")]:zod.string()
When Orval generates the Zod client, this payload is embedded directly into the schema:
export const OpQueryParams = zod.object({ "a":zod.string(),[require("fs").writeFileSync("PWNED","")]:zod.string(),"b": ... })
This results in the execution of `require("fs").writeFileSync("PWNED","")` at module import time.
Protection:
The primary protection is to update to Orval version 8.21.0 or later. The fix involves properly escaping query parameter names using `JSON.stringify` when generating the Zod schema.
If an immediate update is not possible, organizations should audit all OpenAPI specifications processed by Orval to ensure they come from a trusted source. Additionally, enforcing strict Content Security Policies (CSP) in CI/CD pipelines can help limit the impact of arbitrary code execution.
Impact:
Successful exploitation allows an attacker to execute arbitrary JavaScript or operating system commands at import time. This can lead to:
Compromise of build and CI/CD environments
Exfiltration of sensitive environment variables and secrets
Supply chain attacks where a malicious or compromised API specification leads to a backdoored client library
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
