Orval RCE-at-Import: Unescaped Template Literal in Zod "default" Codegen (CVE-2026-72717)

A newly published GitHub Security Advisory (GHSA-w727-8j6c-2rj4, CVE-2026-72717) reports a code-execution flaw in Orval, a popular npm code generator that turns OpenAPI specs into TypeScript client and Zod schema code.

What was reported

According to the advisory, Orval's Zod schema generator emits a schema's default value as a module-level JavaScript template literal — for example export const getIResponseDsDefault = \`<default>\`; — without escaping backticks or ${...} sequences. If the OpenAPI spec's default value contains a string like v${globalThis.ORVPWN()}w, that expression is a live JS interpolation that executes the moment the generated module is imported — no function call or HTTP request required. The reporter says this was verified against Orval 8.19.0, survives default OpenAPI validation, and provided a proof-of-concept (spec + reproduction script) demonstrating a marker written at import time. The advisory notes this is distinct from previously published Orval CVEs (which involved different fields such as summary/MCP, x-enumDescriptions, and const/mock) and from other URL-template-literal issues in the same generator.

Why it matters for defenders

Orval is a build-time/dev-time dependency, but its output — generated Zod schema files — often gets committed or built directly into application bundles. Any workflow where an OpenAPI spec is not fully trusted (pulled from a third-party API, a partner integration, a code-first backend a different team controls, or anything an attacker could influence) creates a path for arbitrary JS execution as soon as a developer or CI pipeline generates and imports the resulting code. This is a supply-chain-style risk: the compromise happens silently at import, not at runtime request handling, making it easy to miss in normal application security review.

What to watch for / do now

• Inventory where Orval is used to generate Zod schemas, and check the Orval version in use against 8.19.0 and later releases for a fix.
• Treat any OpenAPI/Swagger spec ingested from outside your own trust boundary as untrusted input — review specs (especially default fields) before running codegen against them, or generate in an isolated/sandboxed environment.
• Review recently generated schema files for unexpected template-literal syntax or embedded ${ expressions in *Default constants before merging.
• Consider running codegen steps in CI with restricted network/filesystem egress, since import-time execution in a build step can be used to reach further into the pipeline.
• Watch for an official Orval patch and upgrade once available; the advisory's suggested fix is to encode default values with a proper string-literal encoder (e.g., JSON.stringify) rather than raw template-literal interpolation.

This is developing intel based on a same-day advisory and proof-of-concept; details may be refined as the maintainers respond and a fix ships. See the original report for full technical detail: GHSA-w727-8j6c-2rj4.