CVE-2026-72717

Orval's zod schema generator emits an OpenAPI schema's 'default' value as a module-level JavaScript template literal without escaping backticks or '${', so a crafted default such as 'v${<code>}w' injects a live expression (code injection / improper encoding, CWE-94, CWE-116, CWE-1336). The injected expression is evaluated when the generated zod module is imported, so an attacker who controls or influences the OpenAPI description used at codegen time gains arbitrary code execution in the build/CI pipeline or the application at import, with no further request or function call required; the issue was verified on Orval 8.19.0 and survives default OpenAPI validation. Affected users are npm projects that run Orval to generate zod schemas from third-party or otherwise attacker-influenced OpenAPI specs and then import the generated modules. No in-the-wild exploitation is known, CISA KEV does not list it, EPSS assigns a 0.5% probability of exploitation within 30 days (percentile 44), and no public PoC is known beyond the researcher's reproduction scripts attached to the report; CVSS 4.0 rates it 9.3 (critical).

What to do: Inspect generated Orval zod files for module-level '...Default' template literals containing unescaped backticks or '${', and treat OpenAPI 'default' values as untrusted codegen input; avoid importing zod modules generated from attacker-controlled or third-party specs until you can upgrade to an Orval release that encodes defaults via a proper string-literal encoder (e.g., JSON.stringify or backtick/${ escaping), as the maintainers recommend — no fixed version number was available in the data. Also restrict who can supply or modify the OpenAPI description used in CI codegen, and validate or lint generated output for injected expressions.