CVE-2026-71865

Orval, a TypeScript client generator for OpenAPI specs, emits each query parameter name as a double-quoted key in the generated zod.object({...}) request-validation schema without escaping double quotes, so a crafted parameter name can break out of the string key and inject a computed property key ([expr]) containing arbitrary JavaScript. Because the generated module evaluates the expression when zod.object({...}) runs at module load, merely importing the generated client triggers execution — an import-time RCE. An attacker who controls the spec used to generate the client gains arbitrary JavaScript and potentially OS command execution in the Node.js process that imports it. Projects using Orval's zod client — and the hono client, which reuses that zod generation — built from attacker-influenced or untrusted specs are affected; sibling fields (schema property names, header parameter names) are tracked in separate reports. As of this analysis there is no known public exploit or public PoC, exploitation probability is low (EPSS 0.5%), and the flaw is not in CISA KEV.

What to do: Regenerate all zod and hono clients with an orval release that escapes query parameter names (JSON.stringify-style key escaping in zod.object key generation) once a patched version is published, and audit currently generated files for double quotes inside keys or unexpected [...] computed keys. Until patched, treat OpenAPI specs from untrusted sources as untrusted input — validate or sanitize parameter names before generation — and avoid importing generated clients produced from specs you do not control. Also check schema property names and header parameter names, which are the subject of separate reports.