External risk intelligence

Orval Zod Schema Generation Code Execution Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-71866

The vulnerability exists within a build-time tool used to generate code from OpenAPI specifications. It is a developer-centric utility used in CI/CD or local development environments, not a component deployed as an internet-facing service or reachable network application.

SQL Injection

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a code execution vulnerability in a tool that generates type-safe JavaScript clients from API specifications. The issue arises from improper handling of special characters in schema property names, which could allow malicious code to run when generated files are imported by developers or in automated environments. The main concern is confirming relevance and exposure within your development and deployment pipelines.

Malicious code can run in development environments.
Affects tools generating client code from API specs.
Assess if development tools are impacted.

Attack Path

How an attacker could exploit the issue

An attacker could inject malicious JavaScript into a schema property name within an OpenAPI or Swagger specification. When this specification is processed by the Orval tool to generate TypeScript clients, the unencoded double quote in the property name allows for code injection. Importing the resulting schema module in a developer's, CI system's, or application's environment could then trigger the execution of this injected JavaScript.

Malicious specification processed by Orval.
Importing a generated schema module.
Code execution in the development environment.

Live Threat

Current exploitation, exposure, and threat context

When a vulnerable version of Orval is used to generate a zod schema, a specially crafted schema property name containing a double quote could lead to the execution of attacker-controlled JavaScript during the import of the generated schema module. This could affect development, CI/CD, or application environments where these schemas are processed.

Developer or CI/CD environments.
Importing a generated schema module.
Arbitrary code execution in the environment.

Operational Fix

Recommended remediation, mitigation, and detection steps

The potential for code execution when importing generated Zod schema modules suggests that development teams, CI/CD pipeline maintainers, and application owners responsible for integrating OpenAPI specifications are the primary actors. The first practical step is to inventory where Orval is used in the development lifecycle, identify which projects generate code from specifications, and confirm if these generated modules are deployed or executed in sensitive environments.

Development and platform teams own the issue.
Verify Orval usage in code generation.
Update Orval to the fixed version.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Orval and how does it function?

Orval is a utility used by developers to automate the creation of type-safe JavaScript and TypeScript clients. It consumes OpenAPI v3 or Swagger v2 specifications and generates the necessary code to interact with APIs. By automating this process, it helps maintain consistency between an API's definition and the client-side code used in an application.

What vulnerability does CVE-2026-71866 involve?

This CVE involves an improper neutralization of special elements, classified as CWE-95 (Improper Neutralization of Directives in Dynamically Evaluated Code). Specifically, Orval fails to safely encode double quotes within schema property names when creating Zod objects. Because these names are placed directly into the generated code, a malicious property name can break out of its string context and execute arbitrary JavaScript when the generated file is imported.

How is this code execution triggered?

Execution occurs when a developer or automated system imports a Zod schema module that was generated by a vulnerable version of Orval. It is not triggered by simply having the tool installed; the trigger requires processing an API specification that contains a maliciously crafted property name. If the specification does not contain this specific character pattern, the generated code remains safe.

Is my internet-facing service at risk?

According to Halo Surface Signal, this is very unlikely. The vulnerability resides in a build-time tool, not a deployed runtime service. Because Orval is used in development or CI/CD pipelines to generate files, the risk is centered on your build environments, internal developer machines, and automation runners rather than the public-facing application itself.

How do I address this vulnerability?

Start by identifying all projects or CI/CD pipelines where Orval is used to generate Zod schemas. Once you have an inventory of these workflows, update Orval to version 8.21.0 or later. This version corrects how property names are encoded, ensuring that special characters are properly handled during the generation process and preventing unauthorized code execution.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.