Code Execution Vulnerability in Orval JavaScript Client Generator

CVE-2026-71869

What is CVE-2026-71869?

Orval, a tool for generating type-safe JavaScript clients in TypeScript, has a vulnerability that allows attacker-controlled JavaScript to be executed when importing generated zod schema modules. This issue arises from unsafe encoding of a ${...} expression or backtick in an array item default, which leaks into a module-level template literal during schema generation. Developers and systems using versions before 8.21.0 may be exposed to execution risks in their development, CI, testing, or production environments. The issue has been addressed in version 8.21.0.

References