CVE-2026-71871

Orval, an npm code generator that turns OpenAPI specifications into client code and zod schemas, interpolates a header parameter's `default` value verbatim into a module-level JavaScript template literal in the generated zod module, without escaping backticks or `${`. An attacker who controls or can influence the OpenAPI description (for example a third-party, partner-supplied, or user-updated API spec) can embed a live expression in a default value such as `v${someCall()}w`, and the injected code runs the moment the generated module is imported — no HTTP request or function call is needed. Successful exploitation yields arbitrary JavaScript execution with the privileges of the process importing the generated code, i.e. code execution in the application or in the build/CI pipeline. Any project using Orval (verified on version 8.19.0) to generate and import zod schemas from specifications that are not fully trusted is affected. No in-the-wild exploitation, public PoC, or KEV listing is known; EPSS assigns a roughly 0.5% probability of exploitation within 30 days.

What to do: Watch Orval's npm releases/changelog for a patched version that escapes `default` values (the suggested fix emits defaults via JSON.stringify, or escapes backticks and `${` if a template literal is kept) and upgrade as soon as it is available, since no fixed version is stated in this data. In the meantime, treat OpenAPI specifications as untrusted input and review generated zod modules for unescaped `${` or backticks interpolated from spec defaults — the same sink is reachable from several `default`-bearing positions, not just header parameters. After upgrading, regenerate all zod schemas and rebuild/redeploy affected bundles to remove any previously injected defaults.