CVE-2026-72716
Received Received - Intake

Orval JavaScript Client Code Injection via Unsafe Template Literals

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: GitHub, Inc.

Description
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a ${...} expression or backtick in a query parameter default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permits attacker-controlled JavaScript to be evaluated when the generated zod schema module is imported, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/zod/src/index.ts function formatDefaultValue. This issue is fixed in version 8.21.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-72716
EUVD
EUVD-2026-62600

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
orval orval to 8.21.0 (exc)
orval-labs orval to 8.21.0 (exc)
orval-labs orval 8.21.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1336 The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a critical Remote Code Execution (RCE) vulnerability in the Orval npm package affecting versions 8.19.0 and below. It occurs during Zod schema generation where query-parameter defaults are emitted as unsafe template literals. Attackers can inject malicious JavaScript expressions into default values, which execute immediately when the generated module is imported, enabling arbitrary code execution without additional requests.

Detection Guidance

Check if your project uses Orval versions 8.19.0 or below by inspecting package.json or running npm list orval. Look for generated Zod schema files in your project that may contain unescaped ${...} expressions or backticks in query parameter defaults.

Impact Analysis

If you use Orval to generate Zod schemas from OpenAPI specs, an attacker could craft malicious input that executes arbitrary code when your application imports the generated schema. This could compromise your development environment, CI/CD pipeline, tests, or production application, potentially leading to data theft, system damage, or further network infiltration.

Compliance Impact

This vulnerability could lead to unauthorized code execution, potentially causing data breaches that violate GDPR (data protection) or HIPAA (health information privacy). Organizations using affected Orval versions may face compliance violations, regulatory fines, and reputational damage due to compromised systems handling sensitive data.

Mitigation Strategies

Upgrade Orval to version 8.21.0 or later immediately. Review any generated Zod schema files for suspicious default values and regenerate them after updating. Avoid using untrusted OpenAPI specifications.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72716. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart