CVE-2026-71865 orval-labs CVE debrief

Who should care

Developers and users of Orval, especially those using versions prior to 8.21.0, should be aware of this critical vulnerability and take immediate action to update and validate their installations. This includes reviewing and validating generated zod schema modules for potential vulnerabilities and implementing additional security measures to prevent code execution in development environments. Security teams and operators should also review the vulnerability and plan for updates or mitigations as necessary.

Technical summary

A critical vulnerability in Orval, a type-safe JavaScript client generator, allows for code execution in the developer, CI, test, or application environment. The issue arises from a double quote in a query parameter name being emitted into the generated request-validation zod.object({...}) schema without safe encoding, permitting attacker-controlled JavaScript to be evaluated. This vulnerability is fixed in version 8.21.0. The affected code is packages/zod/src/index.ts and query request-validation generation.

Defensive priority

Developers and users of Orval should prioritize updating to version 8.21.0 or later to address the code execution vulnerability.

Recommended defensive actions

• Update Orval to version 8.21.0 or later
• Review and validate generated zod schema modules for potential vulnerabilities
• Implement additional security measures to prevent code execution in development environments
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in Orval, a type-safe JavaScript client generator. A double quote in a query parameter name is emitted into the generated request-validation zod.object({...}) schema without safe encoding, permitting attacker-controlled JavaScript to be evaluated. The issue is fixed in version 8.21.0.

Official resources