Orval npm package can run attacker code

Published September 3, 2026 CVE-2026-71871

Orval is a developer tool that turns API descriptions into ready-to-use code. A booby-trapped API description can make that generated code run an attacker's commands the moment a developer or build system opens it.

Severity
CriticalCVSS 4.0 · 9.3
Fix
Fixed in 8.21.0Fix recorded on Sep 3, 2026
Affected versions
before 8.21.0
Weakness
CWE-94Code Injection
Exploit likelihood
0.48% in 30 daysEPSS, higher than 40% of known flaws
Affects
Orval+1 more

How it works

Orval copies a default value from the API description straight into the generated code without checking it for special characters, so a value crafted with a certain symbol pattern becomes real JavaScript that runs automatically the instant the generated file is loaded.

What to do

Run npm ls orval in your project to see the installed version. Anything before 8.21.0 is affected, especially if you generate code from specs supplied by outside partners or public sources.

Run this in the application environment you want to check:

npm ls orval

Update to Orval 8.21.0 or later with npm install orval@8.21.0, and treat any OpenAPI or Swagger file from an untrusted source as risky until you regenerate code with the fixed version.

Technical details

Affected software: Orval, npm

The bug sits in packages/zod/src/index.ts, function formatDefaultValue. When Orval builds the zod validation schema for a header parameter, it writes the parameter's default value straight into a module-level JavaScript template literal without escaping backticks or ${...} sequences. A default value like v${globalThis.someFunction}w becomes live, executable JavaScript that runs the moment the generated module is imported, no function call needed.

It was verified on Orval 8.19.0 and survives default OpenAPI validation. Fixed in 8.21.0 by properly encoding default values instead of interpolating them into a template literal.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low No extra steps to bypass built-in attack protections
  • Required conditions None No particular deployment or execution condition is required
  • Privileges required None Attacker needs no account or login
  • User action None No action by another user is required
  • Vulnerable system: Data exposure High Sensitive data can be exposed with serious impact
  • Vulnerable system: Data changes High Protected data can be changed with serious impact
  • Vulnerable system: Service disruption High The service can stop or suffer serious disruption
  • Other systems: Data exposure None No additional impact beyond the vulnerable system
  • Other systems: Data changes None No additional impact beyond the vulnerable system
  • Other systems: Service disruption None No additional impact beyond the vulnerable system
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Open in FIRST.org calculator

References

View Original Source