CVE-2026-71868

Orval, an npm tool that generates API clients and zod schemas from OpenAPI descriptions, writes enum-typed 'default' values into generated code as raw module-level template literals without escaping backticks or the ${ sequence. An attacker who controls or influences an OpenAPI specification can set an enum-typed property's default to something like v${<arbitrary JavaScript>}w, so the injected expression is evaluated the moment the generated zod schema module is imported, yielding arbitrary code execution with no request or function call required. The flaw survives Orval's default OpenAPI validation and was verified on version 8.19.0; the vendor notes that a single fix that properly escapes all default values closes every path to the same sink. Any project that generates zod schemas with Orval from an attacker-controlled or attacker-influenced OpenAPI description and imports the generated module is affected. The flaw is rated critical (CVSS 4.0: 9.3); no in-the-wild exploitation or public PoC is known, and EPSS assigns about a 0.5% probability of exploitation within 30 days.

What to do: Until a patched release ships (fixed version not stated in the available data), avoid running Orval against untrusted OpenAPI descriptions, strip backticks and ${ sequences from enum default values, and treat generated zod modules as untrusted code when imported. When a fix is released, upgrade, regenerate all zod schemas, and audit existing generated modules for default values interpolated into template literals; the vendor notes one escape-all-defaults fix closes all affected code paths.