CVE-2026-71864

orval, an npm tool that generates API clients from OpenAPI specifications, fails to escape double quotes when it writes header parameter names as keys into the generated zod.object request-validation schema of its zod client (and the hono client, which reuses that generation). A header parameter name containing a double quote in a spec can break out of the generated string key and inject an attacker-chosen JavaScript expression as a computed property key, which is evaluated when the generated module is imported because the zod.object call runs at module load. An attacker who controls or tampers with header parameter names in a spec used for code generation therefore gains arbitrary JavaScript — and potentially OS command — execution in the Node.js process that imports the generated client, i.e., import-time RCE, scored 9.3 critical under CVSS 4.0. Affected are teams that generate zod or hono clients with orval from specs that are not fully trusted (third-party, partner-supplied, or user-influenced API definitions) and then import the generated code in an application or build pipeline. There is no known exploitation in the wild and no public PoC, it is not in CISA KEV, and EPSS estimates roughly a 0.5% probability of exploitation within 30 days.

What to do: Until a fixed orval release is available (the data does not specify a patched version, so track the orval advisory/changelog), avoid importing zod or hono clients generated from specs you do not fully control. As an interim check, audit OpenAPI specs for double quotes or injection syntax in header parameter names and inspect generated files for unescaped string keys adjacent to computed-key bracket syntax in zod.object schemas. Regenerate and redeploy all zod/hono clients with the patched release once published; related fixes may also cover schema property and query parameter names tracked in separate reports.