Orval npm package can run attacker code

Published September 3, 2026 CVE-2026-71864

Orval is a tool developers use to auto-generate API client code from an API description file. A flaw lets a booby-trapped description file sneak in real code that runs the instant a developer or build system opens the generated file, no extra step required.

Severity
CriticalCVSS 4.0 · 9.3
Fix
Fixed in 8.21.0Fix recorded on Sep 3, 2026
Affected versions
before 8.21.0
Weakness
CWE-94Code Injection
Exploit likelihood
0.61% in 30 daysEPSS, higher than 47% of known flaws
Affects
Orval zod client

How it works

If a header field name in the API description contains a stray quote mark, Orval copies that name straight into the generated validation code without cleaning it up, letting an attacker slip in real JavaScript that runs the moment the generated file loads.

What to do

Check your installed Orval version with npm ls orval and compare it to 8.21.0, and note whether you generate clients from specs supplied by outside parties or third-party APIs.

Run this in the application environment you want to check:

npm ls orval

Update to Orval 8.21.0 or later with npm install orval@latest, then regenerate your API clients before importing them again.

Technical details

Affected software: Orval zod client

Orval: Import-time RCE via header parameter name - computed-property-key injection in the zod client. orval's zod client emits each header parameter name as a double-quoted key in the generated zod.object({...}) request-validation schema WITHOUT escaping the double quote.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low No extra steps to bypass built-in attack protections
  • Required conditions None No particular deployment or execution condition is required
  • Privileges required None Attacker needs no account or login
  • User action None No action by another user is required
  • Vulnerable system: Data exposure High Sensitive data can be exposed with serious impact
  • Vulnerable system: Data changes High Protected data can be changed with serious impact
  • Vulnerable system: Service disruption High The service can stop or suffer serious disruption
  • Other systems: Data exposure None No additional impact beyond the vulnerable system
  • Other systems: Data changes None No additional impact beyond the vulnerable system
  • Other systems: Service disruption None No additional impact beyond the vulnerable system
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Open in FIRST.org calculator

References

View Original Source