CVE-2026-71865

Executive Summary

CVE-2026-71865 is a code injection vulnerability (CWE-94) in Orval, a code generation tool that produces type-safe TypeScript/JavaScript clients from OpenAPI v3 and Swagger v2 specifications. Versions prior to 8.21.0 fail to safely encode double quotes present in query parameter names before emitting them into generated zod validation schemas (zod.object({...})), allowing attacker-controlled JavaScript to be evaluated when the generated schema module is imported. This leads to arbitrary code execution in any environment that imports the generated client code — developer workstations, CI/CD pipelines, test harnesses, or production applications. The vulnerability is patched in version 8.21.0. No CVSS score, EPSS score, or CISA KEV listing is available at the time of writing; patch confidence is rated 0/4 by the tracking source, though the vendor has addressed the issue in a specific release.

Technical Analysis

Orval is a widely used open-source tool that parses OpenAPI v3 and Swagger v2 specification documents (typically JSON or YAML files describing RESTful APIs) and generates corresponding TypeScript client libraries. These generated clients include runtime request validation logic built on the Zod schema validation library. The validation schemas are emitted as static zod.object({...}) definitions inside generated TypeScript modules.

The vulnerability exists in the code generation pipeline, specifically in the query parameter request-validation generation logic. Orval packages/zod/src/index.ts extracts query parameter names from the OpenAPI specification and interpolates them into the generated zod schema as object keys. When a query parameter name contains a double quote character ("), Orval prior to version 8.21.0 emits that character into the generated source code without safety encoding. Because these schema definitions are written into a .ts file that is later compiled and executed, the unescaped double quote breaks the string literal boundary and allows an attacker to inject arbitrary JavaScript code into the generated module. When the module is subsequently imported (e.g., by a test suite, an application at startup, or a build process), the injected JavaScript executes in the context of the importing process.

This is a classic code injection via unsanitized string-to-code generation flaw. The attack does not require the target system itself to be network-facing; rather, the threat emerges when a developer, CI system, or automated pipeline ingests an untrusted OpenAPI specification file. The attack surface is any process that runs Orval against a specification that the attacker controls or can influence — such as a public spec pulled from an external repository, a vendor-supplied SDK generation step, or a spec embedded in a pull request from an untrusted contributor.

The vulnerability class is CWE-94 (Improper Control of Generation of Code — 'Code Injection'). The mechanism is a missing escaping step at the boundary between untrusted data (the spec) and generated code.

Exploitation Scenarios

Prerequisites for exploitation:

• The victim runs Orval version < 8.21.0
• The victim processes a maliciously crafted OpenAPI v3 or Swagger v2 specification
• The generated client code is imported or executed in any environment (developer machine, CI pipeline, test runner, or production node)

Step 1 — Reconnaissance / Target Identification. An attacker identifies organizations that use Orval in their build or development workflows. This can be discovered via public GitHub repositories (searching for orval in package.json or orval.config files), CI logs, or developer blog posts. Alternatively, an attacker may target a supply-chain vector: injecting a malicious spec into a public repository that is known to be consumed by downstream projects using Orval.

Step 2 — Triggering the Flaw. The attacker crafts an OpenAPI specification containing a query parameter whose name includes a double quote character and an injected JavaScript payload. For example, a parameter name such as foo"; process.exit(); // would break out of the generated string literal. Because the NVD description does not provide a specific PoC payload, the exact injection string is not known; however, the vulnerability class permits arbitrary JavaScript code placement within the generated zod.object({...}) schema definition.

Step 3 — Payload Execution. The victim runs Orval (either manually, via a CI pipeline, or via a pre-commit hook) against the malicious spec. Orval generates a .ts client module containing the injected code. When any part of the generated client is imported — for instance, by a test file or an application module — the TypeScript is compiled and executed, and the attacker's JavaScript runs with the privileges of the importing process.

Step 4 — Post-Exploitation. The injected code can perform any action available to the process: exfiltrate environment variables (API keys, cloud credentials, secrets), install persistence mechanisms, modify source files, inject further backdoors into the generated codebase, or pivot to internal networks. In a CI environment, this could grant the attacker access to deployment credentials and production infrastructure. No public PoC is available; the attack chain above is inferred from the vulnerability class and the NVD description.

Impact Assessment

• Business Impact: High for organizations that use Orval as part of their software supply chain. A successful exploit results in arbitrary code execution in trusted development and production environments, which can lead to data exfiltration, credential theft, and supply-chain compromise of downstream software.

• Affected Systems: All environments that import generated Orval clients — developer workstations, CI/CD systems (GitHub Actions, GitLab CI, Jenkins, etc.), test runners, and Node.js applications. Any project using Orval < 8.21.0 is at risk.

• Blast Radius: Because Orval-generated clients are typically committed to source control and distributed through packages, a single compromised generation run can propagate malicious code into multiple downstream consumers. The vulnerability does not require the target to be network-facing, widening the practical attack surface beyond typical externally exposed services.

• CVSS: Not scored (N/A). No EPSS data available from FIRST.org.

Detection Guidance

Sigma Rule

Detection of suspicious code injection patterns in generated TypeScript files within a development or CI environment.

title: Suspicious Code Injection in Orval Generated Zod Schema
id: 7e9cf5b2-8e5b-4c6e-9c80-5c9f3a1d2b3e
status: experimental
description: Detects the presence of double-quote breakout patterns or suspicious function calls within Orval-generated zod schema modules (packages/zod/src).
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-71865
author: Valtersit Threat Intelligence
date: 2026/06/10
logsource:
    category: file_event
    product: windows
detection:
    selection:
        TargetFilename|endswith: '\zod\src\index.ts'
        TargetFilename|contains: 'orval'
    filter_keywords:
        - 'export const'
        - 'z.object'
    condition: selection and filter_keywords
level: high
falsepositives:
    - Legitimate Orval generation runs producing valid zod schemas

YARA Rule

Detection of malicious payload patterns in generated TypeScript source files.

rule Orval_Query_Param_Code_Injection
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects code injection patterns in Orval-generated zod schema files from CVE-2026-71865"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-71865"
        date = "2026-06-10"
        score = 85

    strings:
        $zod_object = "zod.object({"
        $double_quote_breakout = /\w+";.*;[\s]*\/\// 
        $process_call = "process" ascii
        $require_call = "require(" ascii
        $eval_call = "eval(" ascii
        $exec_call = "exec(" ascii
        
    condition:
        $zod_object and $double_quote_breakout and
        (1 of ($process_call, $require_call, $eval_call, $exec_call))
}

Suricata IDS Rule

Detects network-based delivery of malicious OpenAPI specifications containing double-quote payloads in query parameter names.

alert http any any -> any any (msg:"CVE-2026-71865 Orval Query Parameter Code Injection via Malicious OpenAPI Spec"; flow:established,to_server; content:"openapi"; nocase; http.uri; pcre:"/query.*\"[^"]*\";.*\s*\/\//Ui"; sid:20267186501; rev:1; metadata:created_at 2026_06_10, updated_at 2026_06_10; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-71865;)

Elastic Detection

EQL rule to detect malicious content in generated TypeScript files or suspicious process execution during Orval runs.

any where process.name == "npm" or process.name == "node" or process.name == "npx"
// Detect Orval execution with potentially malicious spec files

Splunk SPL Query

Search for Orval execution events combined with script execution or anomalous process chains.

(index=windows OR index=linux) 
| where process_name IN ("npm.exe", "node.exe", "npx.exe") 
| search (command_line="*orval*") 
| table _time, host, user, process_name, command_line, parent_process, parent_process_name

Wazuh OSSEC Rule

<rule id="100265" level="12">
  <if_sid>510, 5710, 550</if_sid>
  <match>orval</match>
  <description>Orval code generator executed — CVE-2026-71865 context, review spec source.</description>
  <group>cve_2026_71865,orval,code_generation,</group>
  <mitre>
    <id>T1190</id>
  </mitre>
</rule>

Mitigation & Patch Guidance

Immediate Mitigations (while unpatched or before upgrade):

1. Do not trust untrusted OpenAPI specifications. If Orval is used to import specs from third-party or public sources, validate the source before processing. Only use signed, vetted, or internally curated specifications.
2. Sanitize/manual review: Prior to running Orval, manually inspect any OpenAPI spec for query parameter names containing double quotes ("), unusual characters, or embedded script-like patterns. Reject specs that fail validation.
3. Sandbox the generation process. Run Orval in an isolated environment (e.g., a container without access to production secrets, a dedicated build runner) so that even if code injection occurs, the blast radius is constrained. Use environment variable restrictions and read-only file systems where possible.
4. Prevent auto-execution. Ensure that generated client modules are not imported automatically in production or CI without prior review. If feasible, require manual review of generated diff before it is merged into mainline code.

Patch / Upgrade Steps:

1. Upgrade to Orval 8.21.0 or later, which properly encodes double quotes in query parameter names before emitting zod schemas.
2. After upgrading, regenerate all existing clients and review the diff to ensure no injected code persists in previously generated files.
3. Audit any previously generated client code (committed or distributed) for signs of injection — inspect zod schema definitions for anomalous string content.
4. Check for any packages published to internal or external registries that may contain compromised generated code.

Long-Term Hardening:

1. Implement a policy requiring that all OpenAPI specs come from trusted, reviewed sources — code review should be mandatory for any spec changes.
2. Add CI pipeline checks that scan generated code for patterns such as double quotes in schema key positions, unexpected function calls, or process-referencing statements.
3. Maintain an inventory of all code generation tools in your build pipeline and track update schedules to ensure timely patching.
4. Consider pinning the Orval version in package manifests and reviewing updates as part of a security patch program.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-71865
2. CWE-94 Reference: https://cwe.mitre.org/data/definitions/94.html
3. Orval Project Repository: https://github.com/anymaniax/orval (note: vendor advisory/CHANGELOG for version 8.21.0 should be referenced if published)
4. Zod Documentation (for schema context): https://zod.dev/
5. ATT&CK Technique T1190: https://attack.mitre.org/techniques/T1190/

Additional note: No threat actor campaigns or in-the-wild exploit evidence are documented for this CVE at the time of writing. No CISA KEV listing. No public PoC or Nuclei template exists. The patch trust level is 0/4 from the tracked source, but version 8.21.0 is confirmed as the fixing release. Security teams should monitor the Orval GitHub changelog and advisory pages for further confirmation.