Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| orval | npm | < 8.21.0 | 8.21.0 |
Miggo AIRoot Cause AnalysisThe vulnerability, CVE-2026-71865, describes an import-time RCE in Orval's Zod client due to improper escaping of query parameter names (or schema property names) when generating zod.object schemas. The core issue is that a double quote in the parameter name could close the string literal key and allow injection of a computed property key, which would then be executed upon module import. The provided commit 8ef1bfdf3f9bcaf9dabfbe2e42887f1c0e159ab6 directly addresses this by modifying the generateZodValidationSchemaDefinition function in packages/zod/src/index.ts. The patch replaces direct string interpolation of key (e.g., "${key}") with JSON.stringify(key). This change ensures that any malicious characters within the key are properly escaped, preventing the injection of arbitrary code into the generated JavaScript. Therefore, generateZodValidationSchemaDefinition is the primary vulnerable function as it was responsible for the insecure generation of the Zod schema keys.
generateZodValidationSchemaDefinitionpackages/zod/src/index.ts