Code Execution Vulnerability in Orval JavaScript Client Generator

CVE-2026-71871

What is CVE-2026-71871?

Orval, a tool designed for generating type-safe JavaScript clients from OpenAPI v3 and Swagger v2 specifications, harbored a vulnerability allowing for code execution. Specifically, prior to version 8.21.0, expressions in header parameter defaults were not properly encoded, which facilitated the injection of attacker-controlled JavaScript into the generated schema module. This could lead to code execution upon importing the module, posing a risk to developers and CI environments. The vulnerability is addressed in version 8.21.0, ensuring safer schema generation practices.

References