Code Execution Vulnerability in Orval JavaScript Client Package

CVE-2026-71868

What is CVE-2026-71868?

Orval, a tool that generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications, contains a vulnerability that could allow attacker-controlled JavaScript to be executed. This occurs due to improper handling of a ${...} expression or backtick in an enum default, which is then emitted into a module-level template literal during zod schema generation. When the generated zod schema module is imported, it may lead to unauthorized code execution within the developer, CI, test, or application environment. The issue was identified in the formatDefaultValue function section of the code and has been addressed in version 8.21.0.

References