CVE-2026-72717
Received Received - Intake

Remote Code Execution in Orval via Unsafe Default Value Handling

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: GitHub, Inc.

Description
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a ${...} expression or backtick in a schema default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permits attacker-controlled JavaScript to be evaluated when the generated zod schema module is imported, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/zod/src/index.ts function formatDefaultValue. This issue is fixed in version 8.21.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-72717
EUVD
EUVD-2026-62657

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
orval orval 8.21.0
orval_labs orval 8.21.0
orval_labs orval to 8.21.0 (exc)
orval_labs orval 8.19.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CWE-116 The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
CWE-1336 The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Orval (versions before 8.21.0) allows code injection through default values in OpenAPI/Swagger schemas. Attackers can insert JavaScript expressions like ${...} or backticks in default values, which are then executed when the generated Zod schema module is imported. This leads to immediate code execution in the importing environment.

Detection Guidance

Check if your Orval version is below 8.21.0 by running npm list orval or checking package.json. Inspect generated Zod schema files for template literals containing ${...} or backticks in default values.

Impact Analysis

This vulnerability enables attackers to execute arbitrary JavaScript code in your development, CI, test, or production environments simply by importing a Zod schema module generated from an attacker-controlled OpenAPI description. This could lead to data breaches, system compromise, or unauthorized access.

Compliance Impact

This vulnerability could lead to unauthorized code execution, potentially causing data breaches or loss of sensitive information. This may violate compliance requirements under GDPR (data protection) and HIPAA (healthcare data privacy), leading to legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Upgrade Orval to version 8.21.0 or later immediately. If unable to upgrade, manually escape default values in OpenAPI specs using JSON.stringify or remove template literals before generation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72717. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart