CVE-2026-71867

Executive Summary

CVE-2026-71867 is a code injection vulnerability in Orval, an open-source tool that generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Affecting versions prior to 8.21.0, the flaw allows a single quote embedded in a schema property name to be emitted unescaped into single-quoted object keys within generated MSW (Mock Service Worker) mock factories. Successful exploitation enables attacker-controlled JavaScript to be evaluated in developer, CI, test, or application environments when the generated mock factory is invoked. The vulnerability carries a CVSS score of N/A, and as of this writing, no patch evidence from tracked sources is available beyond the vendor's fixed release, leaving affected environments exposed. The issue is resolved in version 8.21.0.

Technical Analysis

The vulnerability is rooted in the code generation pipeline of Orval, specifically in the packages/core/src/getters/keys.ts file, within the getKey function, and in the MSW mock generation logic. Orval parses OpenAPI v3 and Swagger v2 specifications to produce TypeScript client code. During this process, schema property names are translated into JavaScript object keys within generated mock factories.

The flaw arises from insufficient sanitization of property names during code emission. When a schema property name contains a single quote character ('), Orval emits this character directly into the generated source code without applying safe encoding or escaping. Because the generated object keys are wrapped in single quotes (e.g., 'propertyName': value), an unescaped single quote breaks the string literal and allows an attacker to inject arbitrary JavaScript code into the generated file.

The attack mechanism is a classic code injection via string interpolation failure. At the class level, this is analogous to SQL injection (CWE-89) in that user-controlled input (the property name) is concatenated into a code or query context without proper parameterization or escaping. In this case, the "query" is the source code of a generated file, and the "injection" is JavaScript syntax.

The affected components are:

• packages/core/src/getters/keys.ts — specifically the getKey function, which constructs object keys.
• MSW mock generation — the module that produces mock factory functions for use with Mock Service Worker.

Attack surface: The primary attack vector is supply chain. An attacker who can influence an OpenAPI/Swagger specification — for example, by compromising an upstream API description, intercepting and modifying a spec during distribution, or submitting a malicious spec to a shared repository — can embed a payload in a property name. When a developer runs Orval to generate clients, the malicious payload is baked into the generated code. The code executes later when the mock factory is called by test suites or MSW handlers.

The vulnerability does not require network exploitation; it is triggered during the software development lifecycle. The injected code runs in the context of the process executing the generated mock factory (e.g., Node.js in a CI pipeline or test runner), with the privileges of that process.

Exploitation Scenarios

Precondition: An attacker must be able to influence the content of an OpenAPI v3 or Swagger v2 specification that Orval processes. This can occur via:

1. Reconnaissance/Target Identification: The attacker identifies a developer or organization using Orval by scanning public repositories, package manifests, or CI configuration files for references to Orval or generated MSW mock factories. Public-facing OpenAPI specifications that are later consumed by Orval are the key target.

2. Triggering the Flaw: The attacker crafts a malicious OpenAPI/Swagger specification containing schema property names with embedded single quotes and JavaScript payloads. For example, a property name might follow the pattern foo'); maliciousCode(); // or similar, which, when emitted unescaped into a single-quoted object key, results in valid injected JavaScript. The malicious spec is delivered to the developer through a poisoned upstream dependency, a compromised API registry, a modified spec file in a shared repository, or a social engineering attack.

3. Payload/Execution Method: At the vulnerability-class level, this is a code injection into a generated artifact. The payload is JavaScript that executes when the generated mock factory is called by unit tests, integration tests, or an MSH handler. The execution environment is the developer's workstation, a CI agent, or a test server. The injected code could execute arbitrary Node.js commands, read environment variables, exfiltrate secrets, or establish persistence.

4. Post-Exploitation Impact: Once code executes, the attacker gains the privileges of the running process. In CI environments, this often includes access to deployment credentials, cloud provider secrets, and source code. In developer environments, the attacker may access local SSH keys, code signing certificates, and other sensitive data. The injected code can modify the generated codebase, creating a persistent backdoor that survives regenerations if the malicious spec is not removed.

Note on attack chain validation: No public PoC or exploit code is available as of this report. The attack chain described above is inferred from the vulnerability class (code injection via insecure string concatenation in code generation) as described in the NVD entry. Specific payload syntax or injection patterns cannot be provided without additional technical details.

Impact Assessment

Business Impact: This vulnerability poses a moderate-to-high risk to organizations that use Orval and consume OpenAPI specifications from untrusted or semi-trusted sources. A successful attack results in arbitrary code execution in development and CI environments, which are often less rigorously monitored than production systems. The compromise of a CI pipeline is particularly damaging because it can lead to the injection of malicious code into production builds, indirectly affecting downstream users.

Affected Systems: Any environment where Orval (versions prior to 8.21.0) is used to generate TypeScript clients with MSW mock factories. This includes developer workstations, CI platforms (e.g., GitHub Actions, GitLab CI, Jenkins), and application build pipelines.

Blast Radius: Code execution in development/CI environments can expose source code, credentials, cloud access keys, and internal infrastructure details. The attack may also enable supply chain propagation if the generated code is published as a package. The CVSS score is N/A, limiting quantitative risk assessments; however, the confidentiality, integrity, and availability impacts are best characterized as High for the CI pipeline and development environments.

Detection Guidance

The following detection rules are designed to identify either the presence of malicious property names in OpenAPI/Swagger specifications or the artifacts of exploitation (unusual JavaScript in generated mock factories). These are provided as hypothetical detection logic based on the vulnerability description; the rules may require tuning to the network and environment.

Sigma Rule

title: Orval Code Injection - Malicious Property Name in OpenAPI Spec
id: 9e3d3a7c-4f56-4a1b-9f2d-6c1e8b4a2f71
status: experimental
description: Detects OpenAPI/Swagger specification files containing schema property names with single quotes, which may trigger CVE-2026-71867 code injection in Orval-generated MSW mock factories.
tags:
    - attack.t1203
    - attack.execution
logsource:
    product: generic
    service: file_stream
detection:
    selection:
        file.extension:
            - yml
            - yaml
            - json
        content|contains:
            - "'"  # Single quote in property name
            - "\";"  # Potential JS injection marker
    condition: selection
level: high
falsepositives:
    - Legitimate API schemas with property names that include single quotes
    - Low likelihood but possible for non-Latin character sets

YARA Rule

rule Orval_Code_Injection_PropertyName  {
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects schema property names with single quotes indicative of CVE-2026-71867 exploitation"
        cve = "CVE-2026-71867"
    strings:
        $prop_quote_js = /['\"][^'\"]*['\"]\s*:/  // Object key patterns
        $single_quote = "'" // Single quote character
        $js_payload = /\);\s*[a-zA-Z_$][a-zA-Z0-9_$]*\(/ // Function call pattern after semicolon
        $openapi = /openapi\s*:\s*["']?3\./ // OpenAPI v3 marker
        $swagger = /swagger\s*:\s*["']?2\./ // Swagger v2 marker
    condition:
        ($openapi or $swagger) and $single_quote and #js_payload >= 2
}

Suricata IDS Rule

Given that CVE-2026-71867 is not a network-exposed vulnerability (it is triggered locally), network detection is challenging. The following rule targets network traffic that may deliver malicious specification files via HTTP/S3 or Git operations. This rule assumes the attacker delivers the malicious spec over the network.

alert http any any -> any any (
    msg:"CVE-2026-71867 - OpenAPI spec with single-quote property names delivered over HTTP";
    flow:to_server,established;
    content:"openapi"; http_uri; nocase; 
    content:"swagger"; http_uri; nocase;
    pcre:"/[a-zA-Z0-9_-]*['\"][^'\"]*['\"]\\s*:/U";
    sid:202671867;
    rev:1; 
    metadata:cve CVE-2026-71867;
)

Elastic Detection

The following EQL rule monitors file writes to detect generated MSW mock factory files containing suspicious injected JavaScript patterns.

sequence with maxspan=5m
  [ file where event.action == "write" and
      file.name : ("*.ts", "*.js") and
      file.path : "*msw*" and
      process.name : "*orval*"
  ]
  [ file where event.action == "write" and
      file.name : ("*.ts", "*.js") and
      file.path : "*msw*" and
      stringContains(file.content, ");") and
      not stringContains(file.content, "semicolon")
  ]

Splunk SPL Query

index=main sourcetype=filesystem
file_name="*.ts" OR file_name="*.js"
| search file_path="*msw*"
| regex file_content="['\"][^'\"]*['\"]\s*:\s*function|['\"]\);\s*[a-zA-Z_$][a-zA-Z0-9_$]*\("
| where NOT file_content LIKE "%already_escaped%"
| stats count by host, file_path, file_name
| sort -count

Wazuh OSSEC Rule

<group name="cve-2026-71867,">
    <rule id="100867" level="12">
        <decoded>
            <field name="file">system.audit.file</field>
        </decoded>
        <match>\.ts$|\.js$</match>
        <regex>"msw" |"mock factory"</regex>
        <regex>'\);\s*[a-zA-Z_$]|\'\s*:\s*function</regex>
        <description>CVE-2026-71867: Possible code injection in Orval-generated MSW mock files</description>
        <group>attack.t1203,execution,</group>
    </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED — no patch evidence from any tracked source is available in the current data repository. However, the NVD description explicitly states that the issue is fixed in version 8.21.0 of Orval. This is noted as a discrepancy; administrators should treat 8.21.0 as the patched release.

Immediate Mitigations:

1. Upgrade Orval: Upgrade to version 8.21.0 or later as soon as possible. This is the only confirmed remediation. Verify the version in package.json or lock files.
2. Audit Generated Code: Review all existing generated MSW mock factories for any object keys containing unescaped single quotes or suspicious JavaScript patterns. Regenerate code with the patched version to eliminate injected payloads.
3. Validate OpenAPI/Swagger Specs: Implement a validation step in the CI pipeline to reject schemas containing property names with single quotes or other control characters. Use JSON Schema validators with strict pattern restrictions for property names (e.g., ^[a-zA-Z0-9_-]+$).
4. Restrict Source of Specifications: Treat OpenAPI/Swagger specs as untrusted input. Only consume specifications from verified and versioned sources (e.g., internal registries, pinned URLs). Do not allow unverified or community-submitted specs to flow into Orval unchanged.

Patch/Upgrade Steps:

1. Update the Orval dependency to ^8.21.0.
2. Run npm install or yarn install to fetch the update.
3. Regenerate all client code and MSW mock factories (orval generate or equivalent command).
4. Re-run the full test suite to ensure no functional regressions and to verify the absence of injected payloads.
5. Optionally, scan the generated code with the YARA or Sigma rules above to confirm clean output.

Long-Term Hardening:

• Implement secrets management in CI environments (e.g., vaulting, short-lived credentials) to limit the blast radius of code execution.
• Run CI pipelines in isolated containers with minimal privileges and no persistent network access.
• Enforce code-review policies that require human approval for changes to OpenAPI/Swagger specifications.
• Use Software Composition Analysis (SCA) tooling to track Orval versions and alert on outdated dependencies.
• Monitor the Orval project's release notes for additional security advisories and patch announcements.

References

1. NVD Entry for CVE-2026-71867: https://nvd.nist.gov/vuln/detail/CVE-2026-71867 — Official NVD record containing the vulnerability description and affected components.
2. Orval Project Repository: https://github.com/anymaniax/orval — Source repository for Orval; the vulnerable code is in packages/core/src/getters/keys.ts. The fix is present in version 8.21.0.
3. OpenAPI Specification (OAS) Documentation: https://swagger.io/specification/ — Reference for OpenAPI v3 and Swagger v2 formats, useful for understanding schema property name constraints.
4. MITRE ATT&CK Technique T1203: https://attack.mitre.org/techniques/T1203/ — "Exploitation for Client Execution," mapping the code injection mechanism to the framework.
5. CWE-89 – SQL Injection (Analogous Class): https://cwe.mitre.org/data/definitions/89.html — While the exact CWE mapping is mechanically CWE-89, the underlying flaw is insecure con