orval

### Summary Orval's zod schema generation emits the **array-items** `default` value as a module-level template literal (`export const …Default = `<default>`;`) without escaping `${` or the backtick. A default of the form `v${<code>}w` injects a live JavaScript expression evaluated when the generated zod schema module is imported, executing attacker-controlled code at import — no request or function call needed. Verified on Orval 8.19.0; survives default OpenAPI validation. ### Details ```ts export const …Default = `v${globalThis.ORVPWN()}w`; // ${...} = arbitrary JS expression, runs at im

CVE: CVE-2026-71869

### Summary orval, when generating MSW mocks (output.mock: true), emits each schema property name as a single-quoted object key in the mock factory WITHOUT escaping the single quote. A ' in a property name closes the key and lands in object-literal context, where an injected computed property key [expr] is evaluated when the mock factory is called (e.g. in tests / MSW handlers) -> RCE. The property name is a pure data field. Verified on orval 8.19.0 / Node. ### Details ```ts export const getOpResponseMock = (...): Thing => ({'x': 0, [require("fs").writeFileSync("PWNED","")]: 0, 'y': faker.

CVE: CVE-2026-71867

### Summary Orval's zod schema generation emits the **enum-typed** `default` value as a module-level template literal (`export const …Default = `<default>`;`) without escaping `${` or the backtick. A default of the form `v${<code>}w` injects a live JavaScript expression evaluated when the generated zod schema module is imported, executing attacker-controlled code at import — no request or function call needed. Verified on Orval 8.19.0; survives default OpenAPI validation. ### Details ```ts export const …Default = `v${globalThis.ORVPWN()}w`; // ${...} = arbitrary JS expression, runs at imp

CVE: CVE-2026-71868

### Summary orval's zod client emits each header parameter name as a double-quoted key in the generated zod.object({...}) request-validation schema WITHOUT escaping the double quote. A " in the header parameter name closes the key and lands in object-literal context, where an injected computed property key [expr] is evaluated when zod.object({...}) runs -- at MODULE IMPORT (export const OpHeader = zod.object({...}) executes on load) -> import-time RCE. The header parameter name is a pure data field. Verified on orval 8.19.0 / Node. ### Details export const OpHeader = zod.object({ "a":zod.st

CVE: CVE-2026-71864

### Summary orval's zod client emits each query parameter name as a double-quoted key in the generated zod.object({...}) request-validation schema WITHOUT escaping the double quote. A " in the query parameter name closes the key and lands in object-literal context, where an injected computed property key [expr] is evaluated when zod.object({...}) runs -- at MODULE IMPORT (export const OpQueryParams = zod.object({...}) executes on load) -> import-time RCE. The query parameter name is a pure data field. Verified on orval 8.19.0 / Node. ### Details export const OpQueryParams = zod.object({ "a"

CVE: CVE-2026-71865

### Summary When Orval is configured with `output.baseUrl.getBaseUrlFromSpecification: true`, it bakes the spec's `servers[0].url` into the generated request URL as a template literal without escaping the backtick. A server URL containing a backtick closes the template literal and injects a concatenation expression evaluated when the generated URL/request function is called, executing attacker-controlled code. Verified on Orval 8.19.0 (fetch client); survives default OpenAPI validation. ### Details ```ts return `http://api.x/` + (globalThis.X = require("fs").writeFileSync("/marker","pwned")

CVE: CVE-2026-62682

### Summary Orval's zod schema generation emits the **header-parameter** `default` value as a module-level template literal (`export const Default = `<default>`;`) without escaping `${` or the backtick. A default of the form `v${<code>}w` injects a live JavaScript expression evaluated when the generated zod schema module is imported, executing attacker-controlled code at import — no request or function call needed. Verified on Orval 8.19.0; survives default OpenAPI validation. ### Details ```ts export const …Default = `v${globalThis.ORVPWN()}w`; // ${...} = arbitrary JS expression, runs a

CVE: CVE-2026-71871

### Summary Orval emits the OpenAPI path into the generated request URL as a TEMPLATE LITERAL (`` `/users/...` ``) without escaping the backtick character. A path containing a backtick closes the template literal and injects a concatenation expression that is evaluated when the generated URL/request/key function is called, executing attacker-controlled code. Affects the axios, fetch, react-query, and swr clients. Verified on Orval 8.19.0; survives Orval's default OpenAPI validation. ### Details ```ts // generated URL builder (fetch client) return `/users/` + (globalThis.X = require("fs").wr

CVE: CVE-2026-62681

### Summary Orval's zod schema generation emits a schema's `default` value as a module-level template literal (`export const …Default = `<default>`;`) without escaping `${` or the backtick. A default of the form `v${<code>}w` injects a live JavaScript expression that is evaluated when the generated zod schema module is imported, executing attacker-controlled code at import — no request or function call needed. Verified on Orval 8.19.0; survives default OpenAPI validation. ### Details ```ts export const getIResponseDsDefault = `v${globalThis.ORVPWN()}w`; ``` `${...}` permits an arbitrary JS

CVE: CVE-2026-72717

### Summary orval's zod client emits each schema property name as a double-quoted key in the generated zod.object({...}) WITHOUT escaping the double quote. A " in a property name closes the key and lands in object-literal context, where an injected computed property key [expr] is evaluated when zod.object({...}) runs -- which is at MODULE IMPORT (the `export const X = zod.object({...})` executes on load) -> import-time RCE. The property name is a pure data field. Verified on orval 8.19.0 / Node. CWE-94 / CWE-95 / CWE-116. ### Details ```ts export const OpBody = zod.object({ "a":zod.string()

CVE: CVE-2026-71866