Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability (CVE-2026-71869) in Orval stems from improper escaping of user-controlled input when generating code, specifically template literals and object keys. The core issue described in the CVE is the import-time RCE via unescaped default values in Zod schema generation. The provided commit addresses this and several related injection vulnerabilities.
generateZodValidationSchemaDefinition (packages/zod/src/index.ts): This function was directly responsible for generating Zod schemas. Before the patch, the defaultValue was constructed by simply replacing single quotes with backticks, which was insufficient to prevent template literal injection. An attacker could craft a default value in the OpenAPI specification containing ${...} or backticks, leading to arbitrary JavaScript execution when the generated Zod schema module was imported. The fix introduces formatDefaultValue which uses jsesc for proper escaping.
getKey (packages/core/src/getters/keys.ts): This function was used to format keys for generated code. Without proper escaping, a key containing a single quote could break out of the generated string literal, allowing for code injection.
getRoute (packages/core/src/getters/route.ts): This function processes OpenAPI paths. Static path segments were directly interpolated into template literals without escaping, making them vulnerable to injection of backticks or ${...}.
getFullRoute (packages/core/src/getters/route.ts): This function constructs the full route, including base URLs and server variables. Similar to getRoute, the serverUrl and variable default values were not properly escaped before being included in template literals, leading to potential code injection.
getRouteAsArray (packages/core/src/getters/route.ts): This function splits routes into an array and wraps segments in single quotes. The lack of proper escaping for single quotes and backticks in these segments allowed for injection.
All identified functions were directly modified in the provided patch to introduce proper escaping mechanisms (like jsesc or JSON.stringify) to prevent code injection. These functions would appear in a runtime profiler when Orval generates code from a malicious OpenAPI specification, leading to the exploitation of the vulnerability.
generateZodValidationSchemaDefinitionpackages/zod/src/index.ts
getKeypackages/core/src/getters/keys.ts
getRoutepackages/core/src/getters/route.ts
getFullRoutepackages/core/src/getters/route.ts
getRouteAsArraypackages/core/src/getters/route.ts
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| orval | npm | < 8.21.0 | 8.21.0 |