External risk intelligence

Orval Zod Code Generation Allows Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-71868

Orval is a build-time development tool used to generate code. The vulnerability exists within the client-side code generation process rather than in a deployed, internet-facing service or application. Exposure is restricted to developer environments, CI/CD pipelines, or internal build processes, making public internet reachability for the vulnerable code generation component not applicable.

Code Injection

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory addresses a vulnerability in Orval, a tool used for generating code from API specifications. The issue allows for the execution of malicious JavaScript code during the schema generation process, potentially impacting developer environments, build systems, and test infrastructure. While the immediate risk is to the development lifecycle rather than deployed applications, it warrants attention to ensure the integrity of these processes.

Code generation tool has a security flaw.
Protects developer and build environments.
Confirm relevance and assess exposure.

Attack Path

How an attacker could exploit the issue

An attacker could compromise a system by providing a specially crafted OpenAPI or Swagger specification file to the Orval tool. When Orval processes this file to generate JavaScript clients, a flaw in how it handles enum default values can lead to the execution of arbitrary JavaScript code within the developer's environment. This could occur during development, in a continuous integration pipeline, or in testing setups.

Requires a malicious specification file.
Triggered during code generation.
Risk of code execution in development environments.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker to execute arbitrary JavaScript code in environments where type-safe JavaScript clients are generated from OpenAPI specifications using Orval. This is possible when a specially crafted enum default value containing JavaScript expressions or backticks is processed during the zod schema generation, and the resulting code is then imported.

Developer or CI/CD environments.
Exploited through crafted OpenAPI specifications.
Arbitrary code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability affects the Orval code generation process, impacting developers, CI/CD pipelines, and internal build environments. Responsibility likely lies with the development or platform engineering teams who manage the OpenAPI to TypeScript client generation. The first step is to identify all instances where Orval is used for code generation, confirm the usage of affected versions, and then plan an upgrade or apply a temporary mitigation.

Development/Platform teams own the fix.
Verify Orval usage and affected versions.
Upgrade Orval to the latest version.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Orval and how is it used?

Orval is a development tool used to automate the creation of type-safe JavaScript clients. Developers provide it with OpenAPI v3 or Swagger v2 specifications, and it generates the corresponding TypeScript code, including Zod schemas for data validation. It is primarily used during the build phase of software development to ensure that client code correctly matches the API contract.

What does CVE-2026-71868 mean for Orval users?

This vulnerability involves improper neutralization of special elements, classified as CWE-94 and CWE-1336. When Orval processes an enum default value containing specific characters, it fails to encode the input safely. This results in the generation of a module that executes unintended JavaScript code whenever the Zod schema is imported, potentially running malicious commands in your environment.

How is this code execution triggered?

The vulnerability is triggered when Orval processes a maliciously crafted OpenAPI or Swagger specification file. If an enum default value contains backticks or ${...} syntax, the generated code will contain these expressions without proper encoding. It is important to note that merely having a vulnerable version of Orval installed does not trigger the bug; the malicious behavior only occurs when Orval is actively used to generate code from a compromised specification file.

Is my organization at risk from this CVE?

Halo Surface Signal indicates that public internet reachability is generally not applicable here because Orval is a build-time tool. Your primary risk is internal, specifically within developer workstations, CI/CD pipelines, or automated test infrastructure where code generation occurs. If your build processes automatically pull or process untrusted API specifications, those environments could be compromised.

What steps should I take to address this issue?

First, audit your projects to identify which ones use Orval for client generation and determine if they are using a version earlier than 8.21.0. Once identified, upgrade Orval to version 8.21.0 or newer across your development environments and CI/CD pipelines to ensure the flawed code generation logic is replaced with the secure implementation.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.