Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| orval | npm | < 8.21.0 | 8.21.0 |
Miggo AIRoot Cause AnalysisThe vulnerability CVE-2026-71871 stems from a failure to properly escape values sourced from an OpenAPI specification before embedding them into generated code, specifically within JavaScript template literals and string literals. The primary impact is a remote code execution (RCE) vulnerability in applications that use Orval to generate Zod schemas from a malicious or compromised OpenAPI specification.
The analysis of the patch commit 8ef1bfdf3f9bcaf9dabfbe2e42887f1c0e159ab6 reveals several vulnerable functions across the orval codebase where this lack of escaping occurs:
generateZodValidationSchemaDefinition: This is the main function highlighted in the CVE. It directly interpolated the default value of a parameter from the spec into a template literal for the generated Zod schema. An attacker could inject code via a crafted default value (e.g., v${...}w), which would be executed when the generated module is imported.
getRoute and getFullRoute: These functions were vulnerable to similar template literal injection attacks through the path and servers[].url fields in the OpenAPI specification, respectively. Maliciously crafted paths or server URLs could lead to code execution.
getKey and getRouteAsArray: These functions were vulnerable to injection through unescaped single quotes. When generating code that uses single-quoted strings (like object keys or route segments), a single quote in the input from the spec could allow an attacker to break out of the string and inject code.
The patch systematically addresses these issues by introducing proper escaping mechanisms at the boundaries where spec-controlled values are used in code generation. It primarily uses the jsesc library to handle escaping for template literals and JSON.stringify or manual replacement for other string contexts. The root cause is a classic code generation vulnerability where input is not treated as data but is instead trusted as code.
generateZodValidationSchemaDefinitionpackages/zod/src/index.ts
getRoutepackages/core/src/getters/route.ts
getFullRoutepackages/core/src/getters/route.ts
getKeypackages/core/src/getters/keys.ts
getRouteAsArraypackages/core/src/getters/route.ts