CVE-2026-72716 orval-labs CVE debrief

Who should care

Developers, CI/CD teams, and security professionals responsible for maintaining and securing applications that utilize Orval-generated JavaScript clients should assess their exposure and apply the fix.

Why it matters

CVE-2026-72716 is a critical vulnerability in Orval that allows for code execution via unsafe JavaScript emission in zod schema generation. Developers and security teams must assess exposure and apply the fix in version 8.21.0 or later.

• Code execution is possible in developer, CI, test, or application environments where the generated zod schema module is imported.
• Immediate attention is required to assess exposure and apply the fix.
• Verification of query parameter default values and ${...} expressions or backticks is necessary.
• Remediation priority is high due to the critical CVSS score of 9.3.

Technical summary

The vulnerability in Orval arises from the unsafe emission of attacker-controlled JavaScript in a module-level template literal during zod schema generation. This occurs when a ${...} expression or backtick is present in a query parameter default value, allowing for code execution in environments where the generated zod schema module is imported. The affected code is in packages/zod/src/index.ts function formatDefaultValue. The issue is fixed in version 8.21.0, and developers must assess exposure and apply the fix.

Defensive priority

Immediate attention is required to assess exposure and apply the fix, as code execution is possible in environments where the generated zod schema module is imported.

Recommended defensive actions

• Assess exposure by checking if the affected code is used in your environment, particularly in packages/zod/src/index.ts.
• Verify if query parameter default values contain ${...} expressions or backticks.
• Apply the fix by updating to version 8.21.0 or later.
• Review and monitor environments where the generated zod schema module is imported.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its critical CVSS score of 9.3 and the affected code in packages/zod/src/index.ts function formatDefaultValue. The fix is available in version 8.21.0.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.