Code Execution Vulnerability in Orval by Orval Labs

CVE-2026-71864

What is CVE-2026-71864?

The vulnerability in Orval affects versions prior to 8.21.0, where a double quote in a header parameter name can lead to an unsafe encoding in the generated zod.object schema. This flaw allows attacker-controlled JavaScript to execute when the schema module is imported. Consequently, it poses a significant risk to developer, CI, test, or application environments, inadvertently enabling code execution vulnerabilities. Users are strongly advised to update to version 8.21.0 or later to mitigate this risk.

References