External risk intelligence

Orval Zod Schema Generation Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-72716

This vulnerability affects a development-time tool used to generate client-side code from API specifications. It is executed within developer environments, CI/CD pipelines, or build processes, rather than acting as a public-facing service, web application, or internet-accessible gateway in production deployments.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a code execution vulnerability in a tool used for generating type-safe JavaScript clients from API specifications. The issue arises from how default query parameters are handled, potentially allowing attacker-controlled code to run when generated schema modules are imported. This could impact development, integration, and testing environments.

Code execution risk in development tools.
Matters if your team uses this API specification tool.
Confirm if this development tool is in use.

Attack Path

How an attacker could exploit the issue

An attacker can compromise development environments by injecting malicious code into OpenAPI or Swagger specifications. When Orval processes these specifications to generate type-safe JavaScript clients, it may include specially crafted query parameter defaults. If these defaults contain untrusted code within template literals, importing the generated schema module can lead to the execution of arbitrary JavaScript in the environment where the module is used.

Entry condition: Malicious input in API specifications.
Trigger point: Importing generated schema module.
Resulting risk: Code execution in development environments.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker to execute arbitrary JavaScript code within development, testing, or application environments. This occurs when a specially crafted default value in a query parameter is used during the generation of a Zod schema, leading to the evaluation of attacker-controlled code when the generated schema module is imported.

Developer or CI environment code.
Malicious code via default query parameters.
Compromised development or build pipelines.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts the Orval tool used for generating JavaScript clients. The primary risk lies in developer, CI, or test environments where the generated code is imported, potentially leading to code execution. Initial triage should focus on identifying where Orval is utilized in the development lifecycle, assessing the sensitivity of these environments, and confirming ownership of the Orval implementation or the CI/CD pipeline.

Identify Orval usage and ownership.
Verify execution context and impact.
Plan developer environment remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Orval and how is it used?

Orval is a development tool that automates the creation of type-safe JavaScript and TypeScript client code by reading OpenAPI v3 or Swagger v2 API specifications. Developers use it to ensure their front-end applications or internal services remain synchronized with API definitions, reducing manual coding errors. Because it automates code generation, it is typically integrated into build processes and software development lifecycles.

What does CWE-1336 mean for CVE-2026-72716?

This vulnerability is classified under CWE-1336, which refers to improper neutralization of special elements during template generation. In the context of CVE-2026-72716, the tool fails to sanitize default query parameter values. When Orval embeds these values into template literals for Zod schema files, it accidentally creates a path for unintended JavaScript code execution whenever those generated modules are subsequently imported by a developer or build system.

How can an attacker trigger this vulnerability?

An attacker triggers this by including malicious input, specifically template expressions like ${...} or backticks, within the default values of query parameters in an API specification file. The vulnerability only manifests when Orval processes these tampered files to generate schema modules; it is not triggered by simply running the Orval tool itself on safe, trusted API definitions.

Who should be concerned about CVE-2026-72716?

Teams utilizing Orval in their development, testing, or CI/CD pipelines should prioritize this. Halo Surface Signal notes that while this tool is rarely exposed as a public-facing service, the risk is concentrated in the build and development environment. If your automated pipelines process API specifications from untrusted or external sources, those systems are at higher risk of unintended code execution during the generation process.

What is the first step to address this risk?

The most effective way to secure your environment is to update Orval to version 8.21.0 or later, where safe encoding for default values is enforced. Before updating, perform an audit to locate every instance of Orval within your development workflows and CI/CD pipelines to ensure the patch is applied across all build environments.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.