External risk intelligence

Orval Zod Schema Code Execution Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-71869

The vulnerability exists in a build-time tool used to generate client code from API specifications. It impacts developer, CI, test, or application build environments rather than acting as a public-facing service, appliance, or network-accessible endpoint in standard production deployments.

Code Injection

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory addresses a vulnerability in Orval, a tool used for generating code from API specifications. The issue could allow an attacker to execute code during the code generation process if a specially crafted API definition is used. The main concern is confirming whether this tool is used within the organization and if so, to what extent.

Issue: Code execution during API client code generation.
Why remember: Impacts developer and build environments.
Executive takeaway: Confirm use and exposure of this tool.

Attack Path

How an attacker could exploit the issue

An attacker could inject malicious JavaScript into an OpenAPI or Swagger specification. When Orval processes this specification to generate type-safe JavaScript clients, it includes the malicious code in a template literal. If this generated code is then imported and used, the attacker's JavaScript will be evaluated in the environment where the code runs, potentially leading to code execution.

No authentication or network access needed.
Default value in API specification.
Code execution in developer environments.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow arbitrary JavaScript code execution within development, build, or testing environments when a generated Zod schema module is imported. This occurs because expressions or backticks in array item defaults are not safely encoded, enabling an attacker to inject executable code.

Code execution in build environments.
Malformed API specification input.
Compromised development or build processes.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts development and CI/CD environments where Orval is used to generate code from API specifications. The first practical step is for development and platform teams to identify where Orval is integrated into their workflows, assess the risk based on the environments affected (developer machines, CI pipelines, testing frameworks), and coordinate with application owners to ensure the fix is applied during the next code generation update.

Application and platform teams own the fix.
Verify Orval usage in CI/CD and development.
Update Orval to the fixed version.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Orval and how is it used in development?

Orval is a developer tool that automatically generates type-safe JavaScript and TypeScript client code directly from API specifications like OpenAPI and Swagger. It is commonly used by engineering teams to ensure their application code stays perfectly synced with API definitions, reducing manual work and improving reliability when building data-fetching layers.

What does CVE-2026-71869 mean by improper neutralization of special elements?

This vulnerability, classified as CWE-94 (Code Injection), occurs because Orval fails to safely encode certain characters—specifically backticks or template literal expressions—found within array default values in your API schema. Because these are inserted directly into generated code, the tool unintentionally allows the inclusion of arbitrary, malicious JavaScript that runs whenever that generated schema file is imported.

How does an attacker trigger this code execution?

An attacker triggers this by placing malicious JavaScript payloads into an API specification file that Orval processes. Crucially, the vulnerability does not require active network traffic or a running production service to succeed; it relies on the tool converting a crafted, malicious schema definition into faulty source code that subsequently executes in the build or developer environment.

How does Halo Surface Signal categorize the risk for this vulnerability?

Halo Surface Signal labels the risk as 'Very unlikely' because the vulnerability exists in a build-time utility rather than a public-facing network service. Since Orval is typically used by internal systems or developers to generate code, it does not represent a traditional internet-facing endpoint, though it can still compromise the security of internal build pipelines and developer workstations.

Do I need to update my production servers for this vulnerability?

No, you do not need to update production servers directly. Instead, you should focus on your development and CI/CD pipelines where Orval is actively used to generate code. Identify projects relying on older versions, then update Orval to version 8.21.0 or newer to ensure the schema generation process correctly encodes inputs and prevents unauthorized code execution.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.