Orval Import-Time RCE: Unescaped Header Defaults Reach Zod Template-Literal Sink (CVE-2026-71871)

What happened

A GitHub Security Advisory (GHSA-8j6p-r8jg-mxqh, assigned CVE-2026-71871) reports that Orval — a code generator that produces TypeScript/Zod client and schema code from OpenAPI specifications — emits the default value of a header parameter directly into a module-level JavaScript template literal (export const Default = `<default>`;) without escaping backticks or ${ sequences. Per the advisory, a header parameter default crafted as v${<attacker JS>}w becomes a live template-literal expression that executes as soon as the generated module is imported — no function call or request required. The reporter states this was verified on Orval 8.19.0, that it survives default OpenAPI validation, and that a PoC (make_spec.py + reproduce.sh) is attached to the advisory demonstrating code execution at import time via a marker write. The advisory also notes this is one of several default-bearing positions that reach the same unescaped sink, so a single escaping fix would likely address related variants.

Why it matters for defenders

This is a supply-chain-adjacent code-generation flaw rather than a runtime application vulnerability: the risk surfaces wherever Orval is used to generate Zod schemas from an OpenAPI/Swagger document that is not fully trusted — for example, specs pulled from third-party APIs, partner integrations, internally federated API catalogs, or any pipeline where an OpenAPI description can be influenced by an outside party. Because execution happens at import time of the generated file, the compromise can occur during a build, CI run, or app startup, well before any application logic runs, making it a plausible vector for build-pipeline or CI/CD compromise for teams that regenerate client code from external specs.

What defenders should watch for or do now

• Inventory usage of Orval in build/codegen pipelines and identify which OpenAPI specs feed it, especially any sourced from third parties or external partners rather than fully internal, trusted definitions.
• Until a patched release is available, treat OpenAPI specs from untrusted or semi-trusted sources as untrusted input — review header parameter default values (and other default fields) for template-literal metacharacters (backticks, ${) before running codegen against them.
• In CI/CD, monitor for anomalous process activity, network calls, or file writes occurring during code-generation/build steps rather than at application runtime — this is where the injected expression would fire.
• Pin and audit the Orval version in use, and prioritize upgrading once an escaping fix lands upstream; re-run codegen against previously-ingested untrusted specs only after patching.
• As a general hardening measure, consider running codegen steps that ingest external specs in an isolated/sandboxed build stage with no access to secrets or production credentials.

Developing intel

This item is based on a same-day GitHub Security Advisory and its accompanying PoC; no CVSS score or broader exploitation data was available at publication time, and details may evolve as the maintainers respond and a fix ships. For full technical detail, the PoC, and updates, see the original advisory: GHSA-8j6p-r8jg-mxqh.