CVE-2026-71864

Executive Summary

CVE-2026-71864 is a code injection vulnerability (CWE-94) in Orval, a widely used TypeScript code generation tool that produces type-safe JavaScript clients from OpenAPI v3 and Swagger v2 specifications. Versions prior to 8.21.0 fail to safely encode double quotes appearing in header parameter names, resulting in attacker-controlled JavaScript being emitted directly into generated Zod validation schemas. When a developer, CI pipeline, test suite, or application imports the generated zod schema module, the injected payload executes in that environment. The vulnerability is fixed in Orval version 8.21.0; no public exploit has been observed, and no CISA KEV listing exists at the time of writing.

Technical Analysis

The vulnerability resides in the Orval code generator's handling of header parameter names when producing request-validation schemas. The NVD description identifies packages/zod/src/index.ts as the affected code location, specifically the header request-validation generation path.

Vulnerability Mechanism:

Orval parses OpenAPI v3 and Swagger v2 specifications to generate TypeScript clients. When constructing a zod.object({...}) schema for request header validation, parameter names from the OpenAPI specification are embedded directly into the generated code. Prior to version 8.21.0, a double quote character (") in a header parameter name is emitted into the output without safe encoding or escaping.

For example, if an OpenAPI specification defines a header parameter named:

X-Malicious")); code_execution_here(); //

Orval would generate JavaScript code containing this string verbatim inside the zod schema object. Because the value is placed inside quoted string literals in the generated validation code, an unescaped double quote terminates the string literal prematurely. Any JavaScript that follows the double quote becomes executable code in the generated module.

Attack Surface:

This vulnerability is part of a supply chain attack vector. The attacker does not target the Orval runtime directly, but rather exploits the code generation pipeline. The malicious payload is injected into the OpenAPI/Swagger specification file, which can be:

1. Sourced from a compromised third-party API — A developer generates a client for a third-party API whose specification has been tampered with.
2. Delivered via a malicious package — An npm package or Git repository contains a poisoned OpenAPI specification.
3. Submitted via pull requests — A contributor with write access (or a compromised maintainer account) introduces a malicious spec file.
4. Served from an insecure API registry — A public API catalog serving tampered specs.

Code-Level Explanation (Class-Level):

The root cause is an injection point in a code generator. Code generators that embed input strings directly into output code without proper escaping are vulnerable to code injection (CWE-94). The injection point is the header parameter name, which is an unlikely place for developers to look when reviewing generated code. The zod.object({...}) structure means the payload executes at module import time — i.e., whenever the generated TypeScript file is loaded by Node.js, a bundler, or a test runtime.

Detailed Flow:

1. Orval parses header parameter names from the OpenAPI spec.
2. These names are concatenated into a string template that produces the zod validation schema.
3. Without escaping, a double quote in the header name terminates the string literal in the generated JavaScript.
4. The remainder of the payload is emitted as code rather than string content.
5. Upon module import (driven by require() or import), the payload executes.

Exploitation Scenarios

Clarification: The NVD description provides no public PoC or exploit code. No Nuclei template exists. The attack chain below is inferred strictly from the vulnerability class (code injection in a code generator) and the description details. Specific payload structures are not available from the description.

Scenario 1: Malicious Upstream API Specification

1. Reconnaissance/Target Identification: An attacker identifies a developer or organization that generates clients with Orval from a specific third-party API specification. The attacker targets the repository or registry that serves the OpenAPI/Swagger JSON/YAML files for that API.
2. Trigger: The attacker injects a header parameter named with embedded double quotes and JavaScript (e.g., X-Data; process.mainModule.require('child_process').exec('calc')) into the specification. The victim runs Orval to regenerate their client.
3. Payload Execution: The generated zod schema file executes the payload when imported in the developer's editor (via type-checking tools), during CI test runs, or in the production application runtime.
4. Impact: Depending on execution context, the attacker achieves code execution with the privileges of the user running the build/test/application. This can lead to credential theft, source code exfiltration, supply chain propagation (if CI artifacts are signed), or lateral movement.

Scenario 2: Compromised Open Source Project

1. Reconnaissance: An attacker targets a popular open-source project that uses Orval to generate its API client from a public spec file.
2. Trigger: The attacker submits a pull request modifying the spec file to include the malicious header parameter, or compromises the maintainer's repository access. The victim's CI pipeline regenerates and builds the client automatically.
3. Payload Execution: The CI environment executes the payload during the build step, leading to shell access inside the CI runner. The attacker can then exfiltrate secrets stored in CI environment variables or SSH keys.
4. Post-Exploitation: The attacker uses CI access to tamper with release artifacts, poisoning downstream consumers of the npm package.

Scenario 3: Insecure API Registry / Documentation Portal

1. Reconnaissance: Attackers target public API directories (e.g., API marketplaces, documentation sites) that allow user-submitted OpenAPI specifications.
2. Trigger: The attacker uploads a malicious spec to the directory. Developers who use Orval to generate clients from these specs become victims.
3. Payload Execution: The payload triggers when the developer runs the generated code locally, enabling ransomware or credential theft on the developer's workstation.

Limitations of Public Information: No public PoC is available. The exact JavaScript syntax required to break out of the generated string becomes dependent on Orval's code template, which is not fully disclosed in the NVD description. Insufficient technical detail is available for a byte-accurate payload construction.

Impact Assessment

Business Impact: The affected population includes any development team using Orval for API client generation, particularly those consuming third-party or user-submitted OpenAPI specifications. The vulnerability is a supply chain risk because it enables code execution within the software development lifecycle (SDLC), which is often overlooked as an attack surface.

Affected Systems:

• Developers using Orval < 8.21.0 for local client generation.
• CI/CD pipelines (Jenkins, GitHub Actions, GitLab CI) that run Orval as part of the build.
• Test environments using generated zod validation schemas.
• Production applications that import the generated TypeScript modules directly.

CVSS Assessment: No CVSS vector was assigned by the CNA. Based on the attack vector (network-delivered via spec file), complexity (medium — requires tampered spec), and impact (code execution), a reasonable estimate would be in the 7.0–8.0 range (High), but this is speculative. Enterprise teams should treat this as a High-severity supply chain risk until formal CVSS scoring is published.

Blast Radius: The blast radius is the entire software supply chain of any organization using Orval. A single malicious spec file can compromise every environment it touches in the pipeline.

Detection Guidance

Detection challenges: No network traffic is required for exploitation if the malicious spec file is already present. The exploit is triggered at build/import time. Detection should therefore focus on:

1. Changes to OpenAPI/Swagger spec files that introduce unusual characters in header parameter names.
2. Unexpected code execution or process spawning during the build/import step.
3. Generated JavaScript files containing non-standard syntax or injected strings.

Sigma Rule

title: Suspicious Header Parameter in OpenAPI Spec Executing Code
id: 3d8f8a9c-2e4f-5b6d-8f1e-9a2b3c4d5e6f
status: experimental
description: Detects an OpenAPI spec file (JSON/YAML) containing a header parameter name with embedded double quotes potentially used for CVE-2026-71864
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-71864
author: Valtersit Threat Intelligence
date: 2026/02/18
logsource:
  category: file_event
  product: generic
detection:
  selection:
    TargetFilename|endswith:
      - '.yaml'
      - '.yml'
      - '.json'
  selection_headers:
    # Look for OpenAPI schema content
    TargetFilename|contains:
      - 'openapi'
      - 'swagger'
      - 'api'
  selection_pattern:
    # Double quote escaping inside header parameter names
    - '*