CVE-2026-71865: CWE-94: Improper Control of Generation of Code ('Code Injection') in orval-labs orval
CVE-2026-71865 is a critical code injection vulnerability in orval-labs' orval software prior to version 8.21.0. The issue arises because a double quote in a query parameter name is emitted into the generated zod schema without safe encoding, allowing attacker-controlled JavaScript to be executed when the schema module is imported. This can lead to code execution in developer, CI, test, or application environments. The vulnerability affects the code in packages/zod/src/index.ts and the query request-validation generation. The issue is fixed in version 8.21.0.
AI Analysis
Technical Summary
Orval is a tool that generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Before version 8.21.0, if a query parameter name contained a double quote, it was directly emitted into the generated request-validation zod.object schema without proper encoding. This unsafe handling permits injection of arbitrary JavaScript code, which is evaluated when the generated zod schema module is imported. This results in code execution in environments where the generated module is used, such as developer machines, continuous integration systems, testing environments, or applications. The vulnerability is located in packages/zod/src/index.ts and the query request-validation generation process. The vulnerability is addressed and fixed in orval version 8.21.0.
Potential Impact
An attacker can craft a query parameter name containing a double quote and malicious JavaScript code that gets injected into the generated zod schema. When this schema module is imported, the malicious code executes, leading to arbitrary code execution in the environment using the generated client. This affects developer, CI, test, or application environments, potentially compromising system integrity and security.
Mitigation Recommendations
Upgrade orval to version 8.21.0 or later, where this vulnerability is fixed. There is no indication of alternative mitigations or temporary fixes. Users should apply the official fix to prevent code injection via query parameter names.
CVE-2026-71865: CWE-94: Improper Control of Generation of Code ('Code Injection') in orval-labs orval
Description
CVE-2026-71865 is a critical code injection vulnerability in orval-labs' orval software prior to version 8.21.0. The issue arises because a double quote in a query parameter name is emitted into the generated zod schema without safe encoding, allowing attacker-controlled JavaScript to be executed when the schema module is imported. This can lead to code execution in developer, CI, test, or application environments. The vulnerability affects the code in packages/zod/src/index.ts and the query request-validation generation. The issue is fixed in version 8.21.0.
CVSS v4.0
Score 9.3critical
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Orval is a tool that generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Before version 8.21.0, if a query parameter name contained a double quote, it was directly emitted into the generated request-validation zod.object schema without proper encoding. This unsafe handling permits injection of arbitrary JavaScript code, which is evaluated when the generated zod schema module is imported. This results in code execution in environments where the generated module is used, such as developer machines, continuous integration systems, testing environments, or applications. The vulnerability is located in packages/zod/src/index.ts and the query request-validation generation process. The vulnerability is addressed and fixed in orval version 8.21.0.
Potential Impact
An attacker can craft a query parameter name containing a double quote and malicious JavaScript code that gets injected into the generated zod schema. When this schema module is imported, the malicious code executes, leading to arbitrary code execution in the environment using the generated client. This affects developer, CI, test, or application environments, potentially compromising system integrity and security.
Mitigation Recommendations
Upgrade orval to version 8.21.0 or later, where this vulnerability is fixed. There is no indication of alternative mitigations or temporary fixes. Users should apply the official fix to prevent code injection via query parameter names.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-08-07T18:26:53.524Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a85eb30acd9273b49667228
Added to database: 08/19/2026, 17:43:12 UTC
Last enriched: 08/19/2026, 17:53:47 UTC
Last updated: 08/19/2026, 22:38:22 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.