Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| orval | npm | < 8.21.0 | 8.21.0 |
Miggo AIRoot Cause AnalysisThe vulnerability (CVE-2026-71868) in Orval stems from insufficient escaping of user-controlled input (specifically default values, server URLs, and path segments from OpenAPI specifications) when generating TypeScript code that uses template literals. This allowed an attacker to inject arbitrary JavaScript expressions into the generated code, leading to import-time Remote Code Execution (RCE). The identified functions (generateZodValidationSchemaDefinition, getRoute, getFullRoute, getRouteAsArray, getKey) were directly responsible for processing and embedding these unescaped values into the generated output. The patches consistently introduce jsesc or manual escaping (replaceAll) to properly sanitize these inputs, thereby mitigating the code injection vulnerability. A runtime profiler would show these functions being called during the code generation process, and if exploited, the injected code would execute during the import of the generated module, potentially appearing in the stack trace originating from these generation functions.
generateZodValidationSchemaDefinitionpackages/zod/src/index.ts
getRoutepackages/core/src/getters/route.ts
getFullRoutepackages/core/src/getters/route.ts
getRouteAsArraypackages/core/src/getters/route.ts
getKeypackages/core/src/getters/keys.ts