Code Execution Vulnerability in Orval JavaScript Client Generation by Orval Labs

CVE-2026-72717

What is CVE-2026-72717?

Prior to version 8.21.0, Orval, a tool for generating type-safe JavaScript clients from OpenAPI and Swagger specifications, contains a vulnerability that allows attacker-controlled JavaScript code to be executed. This occurs because the framework improperly handles ${...} expressions or backticks in schema defaults, leading to unsafe code being emitted into template literals during zod schema generation. Consequently, when the zod schema module is imported, malicious JavaScript could execute in the developer, CI, test, or application environment. The vulnerability is addressed in version 8.21.0, underscoring the importance of updating to mitigate potential risks.

References