Orval Zod Generator: Import-Time RCE via Unescaped OpenAPI Default Values (CVE-2026-71869)

A newly published GitHub Security Advisory (GHSA-2h9g-j24r-h63g, CVE-2026-71869) discloses a critical code-execution flaw in Orval, a popular npm tool that generates TypeScript client code (including Zod schemas) from OpenAPI specifications.

What was reported

According to the advisory, Orval's Zod schema generator emits an array item's default value directly into a module-level JavaScript template literal (e.g. export const XDefault = `<default>`;) without escaping backticks or ${ sequences. If an OpenAPI spec defines an array property with a string default shaped like v${<attacker JS>}w, the injected ${...} expression is evaluated as live JavaScript the moment the generated schema module is imported — no function call, request, or runtime trigger is required. The maintainer report states this was verified against Orval 8.19.0 and notes the underlying unescaped-template-literal sink affects multiple default-bearing positions, not just array items.

Why it matters for defenders

This is a supply-chain-style risk: any team that runs Orval's code generator against an OpenAPI document they do not fully control — a third-party API spec, a spec pulled from a partner, or one populated by user-influenced input — can have arbitrary JavaScript silently baked into their own generated source and executed the instant that file is imported into a build or application. Because the payload lives in generated code rather than a dependency's published package, it can bypass expectations around auditing third-party npm packages, and default OpenAPI validation does not catch it.

What defenders should watch for or do now

• Treat any OpenAPI/Swagger spec ingested from an external or semi-trusted source as untrusted input before running it through Orval or similar codegen tools.
• Review generated Zod schema files (and other Orval output) for unexpected ${...} template-literal interpolations or unfamiliar global references before committing generated code.
• Diff generated output on each regeneration — an unexplained change to a ...Default constant's shape is a strong signal.
• In CI/build pipelines that run codegen against specs from external repos or partner-supplied documents, consider sandboxing or restricting network/process capabilities during the generation step, since execution happens at import time, not at request time.
• Track Orval's release notes for a patched version that properly encodes default values (e.g. via JSON.stringify or full escaping), and upgrade once available — the advisory recommends fixing every default position that reaches this sink, not just the array-items case.

This is developing, net-new intelligence published today with a public proof-of-concept attached; no CVSS score has been assigned yet at time of writing. For full technical details, the maintainer report, and the PoC scripts, see the original GitHub Security Advisory: GHSA-2h9g-j24r-h63g.