Orval npm package can run attacker code

Published September 3, 2026 CVE-2026-71865

Orval is a developer tool that turns API specification files into ready-to-use JavaScript and TypeScript code. A flaw in how it builds validation code lets an attacker sneak commands into that generated code, which run automatically the moment a developer imports it.

Severity
CriticalCVSS 4.0 · 9.3
Fix
Fixed in 8.21.0Fix recorded on Sep 3, 2026
Affected versions
before 8.21.0
Weakness
CWE-94Code Injection
Exploit likelihood
0.48% in 30 daysEPSS, higher than 40% of known flaws
Affects
Orval+2 more

How it works

When Orval turns a query parameter name from the specification into validation code, it copies that name straight into the generated file without checking for a stray quote mark, so a specially crafted parameter name can break out of its slot and insert real JavaScript that runs the instant the file is loaded.

What to do

Check the installed Orval version with npm list orval; anyone on older versions who generates client code from specifications they did not write themselves is affected.

Run this in the application environment you want to check:

npm list orval

Update to Orval 8.21.0 or later with npm install orval@8.21.0, and until then avoid generating zod or hono clients from specification files sourced from outside your own team.

Technical details

Affected software: Orval, zod, hono

Orval's zod client generator writes each OpenAPI query parameter name as a double-quoted object key inside a generated zod.object({...}) schema, without escaping embedded double quotes. A parameter name containing a quote followed by a JavaScript computed property key (for example [require('fs').writeFileSync(...)]) breaks out of the string literal and becomes live object-literal syntax. Because the generated schema is built with a top-level const that executes on module load, the injected expression runs at import time, not when the code is later called.

The hono client, which reuses the same zod generation path, is also affected. The fix in 8.21.0 escapes parameter names with JSON.stringify before emitting them as object keys.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low No extra steps to bypass built-in attack protections
  • Required conditions None No particular deployment or execution condition is required
  • Privileges required None Attacker needs no account or login
  • User action None No action by another user is required
  • Vulnerable system: Data exposure High Sensitive data can be exposed with serious impact
  • Vulnerable system: Data changes High Protected data can be changed with serious impact
  • Vulnerable system: Service disruption High The service can stop or suffer serious disruption
  • Other systems: Data exposure None No additional impact beyond the vulnerable system
  • Other systems: Data changes None No additional impact beyond the vulnerable system
  • Other systems: Service disruption None No additional impact beyond the vulnerable system
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Open in FIRST.org calculator

References

View Original Source