Remote Code Execution Vulnerability in Orval by Orval Labs

CVE-2026-72716

What is CVE-2026-72716?

Prior to version 8.21.0, Orval, a tool for generating type-safe JavaScript clients from OpenAPI v3 and Swagger v2 specifications, contains a vulnerability that results from improper handling of expressions in query parameter defaults. Specifically, the emitted ${...} expressions or backticks are included in module-level template literals during Zod schema generation without adequate encoding. This can allow an attacker to execute arbitrary JavaScript code when the generated Zod schema module is imported, potentially compromising developer, Continuous Integration (CI), test, or application environments. The issue has been addressed in version 8.21.0 of Orval.

References