Code Execution Vulnerability in Orval JavaScript Client Generation Tool
CVE-2026-71867

9.3CRITICAL

Key Information:

Vendor

Orval-labs

Status
Orval
Vendor
CVE Published:
19 August 2026

What is CVE-2026-71867?

Orval, a tool for generating type-safe JavaScript clients from OpenAPI and Swagger specifications, contains a vulnerability that allows attacker-controlled JavaScript to be executed. This issue arises from the improper handling of single quotes in schema property names, which are incorporated into the generated MSW mock factories without adequate encoding. The flawed code exists in the function responsible for generating object keys for mocks, potentially allowing malicious actors to run unverified code in development, CI, or application environments. This vulnerability was addressed in version 8.21.0.

Affected Version(s)

orval < 8.21.0

References

https://github.com/orval-labs/orval/security/advisories/G...
x_refsource_CONFIRM
https://github.com/orval-labs/orval/pull/3692
x_refsource_MISC
https://github.com/orval-labs/orval/commit/8ef1bfdf3f9bca...
x_refsource_MISC

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.