CVE-2026-72717 orval-labs CVE debrief

Who should care

Developers and users of Orval, especially those using versions prior to 8.21.0, should be aware of this critical vulnerability and take immediate action to update and verify their installations. Operators, platform administrators, vulnerability management teams, and security teams should also be aware of the potential impact and take necessary precautions to mitigate the vulnerability. This includes reviewing and verifying the integrity of generated zod schema modules, monitoring for suspicious activity, and planning vendor-supported updates or mitigations.

Technical summary

The Orval library generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to version 8.21.0, a vulnerability in the zod schema generation allows attacker-controlled JavaScript to be evaluated when the generated module is imported, leading to code execution in the developer, CI, test, or application environment. The issue is caused by the emission of ${...} expressions or backticks in schema defaults into module-level template literals without safe encoding. This vulnerability can result in code execution in various environments, including developer, CI, test, or application environments.

Defensive priority

Orval users should prioritize updating to version 8.21.0 or later to address the code execution vulnerability.

Recommended defensive actions

• Update to Orval version 8.21.0 or later
• Review and verify the integrity of generated zod schema modules
• Monitor for suspicious activity in developer, CI, test, or application environments
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE-2026-72717 issue permits attacker-controlled JavaScript to be evaluated when the generated zod schema module is imported, resulting in code execution. The affected code is in packages/zod/src/index.ts function formatDefaultValue. This issue is fixed in version 8.21.0. Developers should verify the integrity of generated zod schema modules and monitor for suspicious activity in developer, CI, test, or application environments. The vulnerability allows for code execution in the developer, CI, test, or application environment due to the emission of ${...} expressions or backticks in schema defaults into module-level template literals without safe encoding.

Official resources