External risk intelligence

Orval Schema Generation Code Execution Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-71864

This vulnerability exists in a build-time tool used for generating client-side code. It is executed within developer environments, CI/CD pipelines, or testing workflows, rather than being a public-facing service or internet-exposed network application.

Code Injection

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A security vulnerability has been identified in a tool used for generating type-safe JavaScript clients. This issue could allow for the execution of attacker-controlled JavaScript during the schema generation process, potentially impacting developer, CI, or application environments. The primary concern is to confirm if this tool is in use and if the affected code paths are integrated into your development or deployment workflows.

Code generation tool can run malicious code.
Affects developer and build environments.
Confirm relevance and exposure of this tool.

Attack Path

How an attacker could exploit the issue

An attacker can inject malicious JavaScript into a header parameter name used by Orval to generate code. When this generated code is imported and used, the embedded JavaScript can be executed in the environment where the code is processed, such as a developer's machine or a continuous integration system. This allows an attacker to achieve code execution in these sensitive environments.

Requires attacker control of a header parameter name.
Triggered when generated schema module is imported.
Risk of code execution in developer or CI environments.

Live Threat

Current exploitation, exposure, and threat context

When the generated zod schema module is imported, attacker-controlled JavaScript could be evaluated, leading to code execution in developer, CI, test, or application environments.

Developer environments and code integrity at risk.
Malicious code injected via header parameter name.
Compromised build processes and data exposure.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts the code generation process, likely affecting development teams, CI/CD pipelines, or testing environments. The first practical step is for the platform or application owner to identify where Orval is used in the development lifecycle, confirm if the affected versions are present, and assess the risk to developer or build environments.

Platform or application owners should investigate.
Verify Orval usage in development and CI/CD.
Plan updates or code review for affected projects.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Orval and how is it used?

Orval is a specialized developer tool used to automate the creation of type-safe JavaScript and TypeScript clients. It takes API definitions, specifically OpenAPI v3 and Swagger v2 specifications, and generates the necessary code to interact with those APIs. Developers rely on it to ensure their front-end or service-to-service communication remains consistent with the backend API contract.

What does CVE-2026-71864 mean?

This vulnerability is classified as Improper Neutralization of Input during Code Generation, often leading to code injection. Essentially, Orval fails to properly encode double quotes found in header parameter names. When these names are placed into the generated code, an attacker can manipulate them to inject their own JavaScript. This injected code runs automatically whenever the affected Zod schema module is imported by a developer or build system.

How is this vulnerability triggered?

An attacker must be able to influence the header parameter names defined within your API specification files. If an attacker controls those names, the malicious payload is embedded during the generation process. This issue is not triggered by simply visiting a website; it is only activated when the compromised, generated code is actually imported and executed within a development, CI/CD, or application environment.

Is this vulnerability relevant to me?

According to Halo Surface Signal, this is very unlikely to affect internet-facing services because it resides in a build-time tool rather than a live network application. The risk is concentrated in your internal development lifecycle. You should care if you use Orval to generate code, as your CI/CD pipelines, local developer machines, or automated test environments could be susceptible if they process untrusted API specifications.

What should I do to address this?

Your first step is to perform an inventory of your repositories to identify where Orval is used in your build processes. Check if any project is utilizing a version earlier than 8.21.0. If you are on an older version, update to 8.21.0 or later, which includes the necessary encoding fixes to sanitize header parameters during schema generation.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.