CVE-2026-71871 orval-labs CVE debrief

Who should care

Developers and users of Orval, especially those who generate type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications, should be aware of this vulnerability and take necessary actions to update to a secure version. They should review their environments for affected deployments and prioritize updating to version 8.21.0 or later.

Technical summary

The Orval library generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to version 8.21.0, a vulnerability exists in the packages/zod/src/index.ts file, specifically in the formatDefaultValue function. This function improperly handles ${...} expressions or backticks in header parameter defaults, emitting them into module-level template literals without safe encoding. As a result, when the generated zod schema module is imported, attacker-controlled JavaScript can be evaluated, leading to code execution in the developer, CI, test, or application environment.

Defensive priority

Developers and users of Orval should prioritize updating to version 8.21.0 or later to address the code execution vulnerability.

Recommended defensive actions

• Update to Orval version 8.21.0 or later
• Review and validate generated zod schema modules
• Implement secure coding practices for template literals
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE-2026-71871 issue permits attacker-controlled JavaScript to be evaluated when the generated zod schema module is imported, resulting in code execution. The affected code is in packages/zod/src/index.ts function formatDefaultValue. This issue is fixed in version 8.21.0. Developers should verify the presence of affected product deployments in their environments and review official advisories for scope, severity, and guidance. They should also check for compensating controls and monitor for potential exposures.

Official resources