CVE-2026-71866 orval-labs CVE debrief

Who should care

Developers and CI/CD teams using Orval versions between 8.19.0 and 8.21.0 should assess exposure and update to version 8.21.0 or later. This vulnerability can lead to code execution in development, CI, test, or application environments, making it a critical concern for teams working with Orval.

Why it matters

CVE-2026-71866 is a critical vulnerability in Orval that allows for code execution via generated zod schema modules. Developers and CI/CD teams using affected versions must assess exposure and update to version 8.21.0 or later to mitigate the risk. The vulnerability's impact includes potential code execution in development, CI, test, and application environments.

• Code execution in development environments can lead to supply chain compromise.
• CI/CD pipelines may be vulnerable to exploitation, potentially affecting build and deployment processes.
• Test environments may be used as an attack vector, allowing for further exploitation.
• Application environments are at risk of code injection, potentially leading to security breaches.

Technical summary

The vulnerability in Orval arises from a double quote in a schema property name being emitted into the generated zod.object({...}) schema without safe encoding. This allows attacker-controlled JavaScript to be evaluated when the generated zod schema module is imported, resulting in code execution in the developer, CI, test, or application environment. The issue affects Orval versions from 8.19.0 to 8.21.0 and is fixed in version 8.21.0.

Defensive priority

Immediate attention is required for developers and CI/CD teams using Orval versions between 8.19.0 and 8.21.0. Assess exposure by reviewing project dependencies and update to version 8.21.0 or later. Verify generated zod schema modules for potential malicious code injection.

Recommended defensive actions

• Update Orval to version 8.21.0 or later
• Review project dependencies for affected versions
• Verify generated zod schema modules for potential malicious code injection
• Assess exposure in development, CI, test, and application environments
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its critical CVSS score of 9.3. The issue is caused by a double quote in a schema property name not being safely encoded in the generated zod schema, allowing for code execution. The affected code is in packages/zod/src/index.ts and zod object-key generation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.