External risk intelligence

Orval Code Generation Vulnerability Allows JavaScript Evaluation.

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-71867

This vulnerability exists in a build-time tool (Orval) used to generate code. The affected code is part of a development dependency and is executed during testing or mock server generation, not within a public-facing application runtime. It is not an internet-exposed service or network-facing component.

SQL Injection

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a vulnerability in Orval, a tool used to generate JavaScript clients from API specifications. The issue allows for code execution in development or testing environments if a single quote is present in certain schema property names, leading to the evaluation of attacker-controlled JavaScript. The main concern is confirming relevance and exposure within your development and testing pipelines.

Unsafe code generation in development tools.
Code execution risk in testing and build processes.
Confirm Orval usage and exposure in your pipelines.

Attack Path

How an attacker could exploit the issue

An attacker could introduce a malicious single quote into a schema property name within an OpenAPI or Swagger specification. When Orval processes this specification to generate mock factories, the unsafe encoding of this quote allows for attacker-controlled JavaScript to be evaluated. This code execution occurs in the environment where the generated mocks are used, such as during development, testing, or within an application's mock server setup.

An attacker needs to control schema property names.
The vulnerability triggers when generated mocks are called.
Results in code execution in developer environments.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in Orval could allow malicious JavaScript to be executed in development, testing, or application environments when generated mock factories are invoked. This occurs because a single quote in a schema property name is not safely encoded, enabling code injection.

Developer or application code execution.
Code runs when mock factories are called.
Compromise of local development environments.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability resides within Orval, a development tool used for generating code from API specifications. Real-world remediation falls to development teams and potentially platform or CI/CD teams responsible for the build and testing environments where Orval is utilized. The initial practical step is to identify where Orval is integrated into the development workflow, confirm its usage in critical or exposed pipelines, and then update the tool to a secure version.

Development and platform teams own the issue.
Verify Orval usage in CI/CD pipelines.
Update Orval to version 8.21.0.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Orval?

Orval is a development tool that automatically builds type-safe JavaScript clients by reading API specifications like OpenAPI or Swagger. Developers use it to simplify the process of connecting their applications to backend services, ensuring that the generated code aligns with their API schema. By automating client generation, it saves time and reduces manual errors, typically running during the build or development phases of a project.

What does CVE-2026-71867 mean for code safety?

This vulnerability is an instance of Improper Neutralization of Special Elements, specifically related to code injection. Because Orval fails to safely encode single quotes in schema property names, it can inadvertently insert these quotes into mock factory files. When those files are executed during testing, the injected characters can cause the system to interpret data as executable JavaScript commands instead of simple labels, potentially leading to unauthorized code execution.

How is this vulnerability triggered?

The flaw is triggered when Orval processes an API specification file that contains a single quote in a property name. The vulnerability does not activate simply by having the tool installed; it requires the malicious or malformed property name to exist in the schema and for the resulting mock factory to be subsequently executed in a test, CI, or development environment.

Is this vulnerability a risk for my public website?

According to Halo Surface Signal, this vulnerability is considered very unlikely to affect public-facing systems. Because the issue exists in a build-time dependency used for generating test mocks, it is generally confined to local developer machines or internal CI/CD pipelines. It is not an internet-exposed service, so the risk is focused on your internal development and testing infrastructure rather than your live application runtime.

How do I address this CVE in my project?

The primary step is to identify where Orval is integrated into your build processes or CI/CD pipelines. Once you have located the relevant project dependencies, you should update your Orval package to version 8.21.0 or higher. This update includes the necessary encoding logic to handle schema property names safely and prevent the unintended evaluation of JavaScript during mock generation.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.