CVE-2026-71869

Orval's zod schema generator writes array-item default values taken from an OpenAPI description directly into a module-level JavaScript template literal without escaping backticks or dollar-brace sequences, so a crafted default value injects a live JavaScript expression into the generated module (CWE-94, CWE-116, CWE-1336). The injected expression executes when the generated zod schema module is imported, so no network request, function call, privileges, or user interaction is required beyond the application loading the generated code. An attacker who controls or can influence the OpenAPI specification used for generation therefore gains arbitrary code execution in the importing process, consistent with the critical CVSS 4.0 score of 9.3 with high confidentiality, integrity, and availability impact. Affected users are npm projects that generate zod schemas with Orval (verified on version 8.19.0) and import those generated modules from attacker-controlled or attacker-influenced specs; the reporter notes several other default-value positions reach the same unescaped sink and one escaping fix is expected to cover all of them. There is no known public proof-of-concept release, the issue is not in CISA KEV, and EPSS estimates about a 0.5% chance of exploitation within 30 days (40th percentile), although the researcher's reproduce.sh demonstrates a marker file being written at import time on 8.19.0.

What to do: Treat Orval's zod output as vulnerable until a patched release is published (no fixed version is stated in the available data), then upgrade Orval and regenerate all zod schema modules. In the interim, audit the OpenAPI descriptions you feed to Orval for default values containing backticks or dollar-brace sequences and scrub or escape them, or post-process generated files so defaults are emitted through a proper string encoder such as JSON.stringify. Watch the maintainer advisory closely, since the CNA may consolidate several related default-injection reports into a single fix.