CVE-2026-71864: CWE-94: Improper Control of Generation of Code ('Code Injection') in orval-labs orval

Orval is a tool that generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Before version 8.21.0, the tool improperly handled double quotes in header parameter names by inserting them directly into the generated zod.object schema without safe encoding. This flaw permits injection of malicious JavaScript code that executes upon importing the generated schema module, leading to code execution in environments such as development, continuous integration, testing, or production applications. The vulnerability affects the code in packages/zod/src/index.ts and the header request-validation generation logic. The issue is resolved in version 8.21.0.

An attacker who can control header parameter names in the OpenAPI or Swagger specification used by orval can inject arbitrary JavaScript code that executes when the generated zod schema module is imported. This results in remote code execution in the developer's or application's environment, potentially compromising the integrity and security of the affected systems. The CVSS 4.0 score is 9.3 (critical), reflecting the high impact and ease of exploitation without privileges or user interaction.

Upgrade orval to version 8.21.0 or later, where this vulnerability is fixed. No other mitigation is required as the fix addresses the unsafe encoding of header parameter names in the generated code.