CVE-2026-71868 orval-labs CVE debrief

Who should care

Developers and users of Orval, especially those using versions prior to 8.21.0, should be aware of this critical vulnerability and take immediate action to upgrade to the latest version. Additionally, operators, platform administrators, vulnerability management teams, and security teams should review the generated zod schema modules and validate the input to the formatDefaultValue function to prevent code execution.

Technical summary

The CVE-2026-71868 issue is a critical vulnerability in Orval, a tool for generating type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to version 8.21.0, a ${...} expression or backtick in an enum default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permits attacker-controlled JavaScript to be evaluated when the generated zod schema module is imported, resulting in code execution in the developer, CI, test, or application environment. The affected code is in packages/zod/src/index.ts function formatDefaultValue. This issue is fixed in version 8.21.0.

Defensive priority

Developers and users of Orval should prioritize upgrading to version 8.21.0 or later to address the code execution vulnerability.

Recommended defensive actions

• Upgrade to Orval version 8.21.0 or later
• Review and validate the generated zod schema modules
• Implement compensating controls to detect and prevent code execution
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE-2026-71868 issue permits attacker-controlled JavaScript to be evaluated when the generated zod schema module is imported, resulting in code execution. The affected code is in packages/zod/src/index.ts function formatDefaultValue. This issue is fixed in version 8.21.0. To verify, defenders should review the generated zod schema modules, check for suspicious JavaScript execution, and validate the input to the formatDefaultValue function. Additionally, defenders should ensure that the Orval version is upgraded to 8.21.0 or later to address the code execution vulnerability.

Official resources