External risk intelligence

Orval Code Generation Vulnerability Allows JavaScript Evaluation

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-71865

Orval is a development-time tool used to generate client code from API specifications. It operates within developer environments, CI/CD pipelines, or build processes, not as a deployed, internet-facing service or application component.

Code Injection

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a code execution vulnerability in Orval, a tool used to generate JavaScript clients from API specifications. The vulnerability arises from improper handling of query parameter names, which could allow an attacker to inject and execute malicious JavaScript within development, build, or testing environments when generated schema modules are imported. The primary concern is to confirm if Orval is used and if the affected code paths are exposed.

Code execution risk in development environments.
Matters if Orval is used to generate client code.
Confirm Orval usage and exposure relevance.

Attack Path

How an attacker could exploit the issue

An attacker can inject malicious JavaScript into a project by manipulating the name of a query parameter within an OpenAPI or Swagger specification. When the generated code that validates these parameters is imported and used, the embedded JavaScript can be executed. This can occur in various environments where the generated code is processed, such as during development, in continuous integration pipelines, or within running applications.

No access or privileges needed.
Vulnerable code is imported.
Allows arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

When the generated zod schema module is imported, attacker-controlled JavaScript could be evaluated. This could affect the developer, CI, test, or application environments where the schema is processed.

Code execution in development environments.
Importing generated schema modules.
Compromise of build or application systems.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in Orval affects the code generation process, meaning the primary responsibility likely lies with development teams, platform engineers managing build tooling, or security teams overseeing CI/CD pipelines. The first practical step is to identify which development environments or build processes utilize the affected version of Orval, determine if these processes handle sensitive data or execute in privileged environments, and then confirm ownership for remediation.

Development and platform teams own the issue.
Verify Orval usage in CI/CD and dev environments.
Update Orval to the fixed version.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Orval?

Orval is a developer tool that automatically creates type-safe JavaScript and TypeScript client code from API definitions like OpenAPI v3 and Swagger v2. Developers use it to simplify building network requests for their applications. Because it runs during the build or development phase, it serves as a bridge between API specifications and the actual code running in a browser or on a server.

What is the vulnerability in CVE-2026-71865?

This vulnerability is an improper neutralization of input, classified under CWE-94, CWE-95, and CWE-116. It occurs because Orval does not properly encode double quotes in query parameter names when creating validation schemas. This mistake allows malicious code to be embedded directly into the generated files, which then runs unexpectedly when the application imports or processes these schemas.

How does an attacker trigger this issue?

An attacker triggers the vulnerability by including a malicious query parameter name within an OpenAPI or Swagger specification file that Orval processes. If the specification is benign or contains only standard parameter names, the bug is not triggered. The execution only happens when the generated Zod validation schema is imported by a developer's environment, a CI pipeline, or an application.

Do I need to worry if my code is internal?

Yes, you should care regardless of whether your application is internet-facing. Halo Surface Signal identifies Orval as a development-time tool that typically operates within internal build processes and CI/CD pipelines. Even if the application is not exposed to the internet, a compromised API specification used in your local development environment could still lead to code execution in your private build or test systems.

How do I address this CVE?

The first step is to identify all projects or build pipelines in your organization that use Orval versions prior to 8.21.0. Once you have identified these instances, you should update Orval to version 8.21.0 or later, which includes the necessary fixes for safe parameter encoding. Ensure that development and platform teams are informed, as they generally manage the build tooling and dependencies where this issue manifests.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.