CVE-2026-72716

Executive Summary

CVE-2026-72716 is an unauthenticated code-injection vulnerability (CWE-1336) affecting Orval, a widely used TypeScript code generator that produces type-safe JavaScript clients from OpenAPI v3 and Swagger v2 specifications. All versions prior to 8.21.0 are vulnerable. The flaw resides in the generated Zod schema module — specifically in the formatDefaultValue function within packages/zod/src/index.ts — where attacker-controlled query parameter defaults containing ${...} template-literal expressions or backticks are emitted into module-level template literals without safe encoding.

Exploitation does not require direct access to the generated code's runtime environment. Instead, the attack is embedded in the OpenAPI specification itself. When a developer, CI pipeline, or test environment imports the generated Zod schema module, the attacker-controlled JavaScript is evaluated, resulting in arbitrary code execution in that build/development/CI environment. The impact is supply-chain in nature — a malicious or compromised OpenAPI specification can result in code execution on developer workstations, CI runners, and application build pipelines.

Technical Analysis

Orval generates type-safe JavaScript/TypeScript clients from OpenAPI v3 and Swagger v2 specifications. A core feature is the generation of Zod schemas for runtime validation of request/response data. These schemas are emitted as TypeScript modules that are later imported by consuming applications, build pipelines, and test suites.

The root cause of CVE-2026-72716 is an injection flaw in the code-generation logic itself. When Orval processes a query parameter that contains a default value, that default value is passed through the formatDefaultValue function in packages/zod/src/index.ts (per the NVD description). For the generated Zod schema to correctly represent default values, Orval embeds those values into module-level template literals in the generated .ts output.

The vulnerability is that Orval does not safely encode or sanitize the default value before inserting it into the template literal. If a query parameter's default value contains a ${...} expression or a backtick (`), that content is written verbatim into the generated code within a template literal context. Template literals in JavaScript/TypeScript evaluate embedded ${...} expressions at runtime. Therefore, when the generated Zod schema module is subsequently imported — in a developer's IDE, a CI pipeline, a test execution, or a production application — the attacker-controlled expression executes.

The attack surface is therefore the OpenAPI/Swagger specification itself. An attacker could:

1. Compromise a repository containing OpenAPI specifications that are consumed by Orval-based code generation pipelines.
2. Submit a pull request or direct commit to a public specification repository with a malicious query parameter default.
3. Attack a development team that fetches OpenAPI specs over HTTP (e.g., from a compromised internal API discovery service).
4. Poison an internal API catalog or service registry that is used as input to Orval.

The resulting code execution occurs at the moment of import — i.e., the very first time the generated Zod schema module is loaded. Given that this import typically happens during development, test execution, CI builds, or application startup, the attacker's code runs with the privileges of the user or service executing those processes.

From a code-level perspective, the flaw class is that of improper encoding/output encoding (CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine). The generator treats developer-contributed spec inputs as trusted data and injects them into a code-generation template without escaping template-literal delimiters. This is analogous to SQL injection but in a code-generation context — the "database" is the generated module, and the "query" is the import statement.

Exploitation Scenarios

Stage 1 — Reconnaissance / Target Identification

An attacker begins by identifying organizations that use Orval to generate API clients. This is discoverable through:

• Public repositories referencing orval in package.json, orval.config.ts, or CI pipeline scripts (e.g., .github/workflows/*.yml mentioning orval commands).
• npm package dependencies in publicly accessible manifests.
• OpenAPI specification repositories (e.g., api-specs, openapi, swagger) where Orval is referenced as a generation tool.
• Corporate API documentation portals that expose their OpenAPI spec files.

Stage 2 — Triggering the Flaw Class

The attacker must cause a malicious query parameter default to be processed by Orval. The most likely vectors are:

• Compromised spec repository: An attacker with write access to a shared OpenAPI specification repository adds a query parameter such as a filter, sort, or pagination parameter, and sets its default value to contain a template-literal injection payload instead of a benign value.
• Malicious pull request: A PR is submitted to a public spec repository with the injection payload. Because spec changes often require less rigorous review than code changes (especially in documentation-like repos), this can be merged accidentally.
• Man-in-the-Middle on spec fetch: If an organization fetches OpenAPI specs over unauthenticated HTTP from an internal service, an attacker on the network can replace the legitimate spec with a malicious one.
• Supply-chain poisoning of a reused spec: Attackers compromise a third-party API vendor's public spec file, knowing downstream consumers regenerate clients.

Stage 3 — Payload / Execution Method

The malicious default value is crafted to inject JavaScript into the generated Zod module. The payload takes the general class of a template-literal expression, e.g., a value containing ${...} with attacker-controlled JavaScript body. Orval's formatDefaultValue function emits this value into the module-level template literal without escaping, so the payload is evaluated when the module is imported.

At the vulnerability-class level, the payload exploits the lack of encoding between the spec's default value and the generated module's template literal. The attacker-controlled string becomes active JavaScript in the generated file. Common payload outcomes at the class level include process spawning, file exfiltration, environment variable access, or machine persistence.

Stage 4 — Post-Exploitation Impact

Once code execution is achieved, the attacker operates within the context of the process importing the generated module. Depending on the environment:

• Developer workstation: Lateral movement to source code, SSH keys, cloud credentials (e.g., ~/.aws/credentials), password managers, and other developer secrets.
• CI/CD runner: Access to pipeline secrets, deployment credentials, artifact storage, and the ability to push malicious artifacts into downstream production systems.
• Test/QA environment: Compromise of test databases, internal API credentials, and false-positive/false-negative test manipulation.
• Production application: Full remote code execution on application servers, database access, and data exfiltration.

The attack is stealthy: the code executes at import time, before any application logic runs, and the generated module looks syntactically valid, making manual code review of generated files unlikely to catch the payload.

Impact Assessment

The impact of CVE-2026-72716 is best characterized as a supply-chain integrity failure with direct code-execution consequences. The compromise surface is broad, as Orval is a cross-industry tool used by enterprises generating typed API clients in TypeScript ecosystems. Any organization that consumes third-party OpenAPI specifications and generates Zod schemas with Orval prior to version 8.21.0 is at risk.

Technical impact — The CVSS score is not available (N/A), so no numeric severity is assigned. However, based on the vulnerability class, the impact is High to Critical: arbitrary code execution with no authentication required, triggered by software supply-chain interaction. The attack requires no runtime network access to the target — only for the victim to import the maliciously generated module.

Business impact:

• Developer infrastructure compromise: Loss of source code, secrets, signing keys, and intellectual property.
• CI/CD pipeline poisoning: Subverted build and release pipelines, potentially affecting production deployments across all software produced by the organization.
• Data breach: Access to databases and cloud resources from compromised build environments.
• Reputational damage: If a public spec repository is compromised and distributed as a package dependency.

Blast radius — Every project that:

• Uses Orval < 8.21.0,
• Generates Zod schemas from OpenAPI v3 or Swagger v2 specs,
• And imports those generated schemas within an automated pipeline.

The vulnerability is particularly dangerous because it targets the developer/build environment rather than the production application, meaning traditional web application firewalls (WAFs) and runtime intrusion detection systems deployed at the application edge provide no visibility or protection.

Detection Guidance

Sigma Rule

title: Suspicious Template Literal Injection in Orval Generated Zod Schemas
id: b9c7e1f0-3a2c-4d8e-9f5a-6b1c2d3e4f5a
status: experimental
description: Detects import of Orval-generated Zod modules containing suspicious template literal expressions in query parameter default values.
references:
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72716
tags:
    - attack.t1190
    - cve.2026.72716
    - cwe.1336
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith:
            - '/node'
            - '/npm'
            - '/yarn'
            - '/ts-node'
        CommandLine|contains:
            - 'zod'
            - 'orval'
            - 'generate'
    filter_generic:
        CommandLine|contains:
            - '--help'
            - '--version'
    filter_payload:
        CommandLine|contains:
            - '${'
    condition: selection and not filter_generic and filter_payload
level: high
falsepositives:
    - Legitimate template literals in spec default values used as actual default parameters
    - Developers intentionally using computed default values
    - Low likelihood of false positive; any ${ in generated code is suspicious

YARA Rule

rule CVE_2026_72716_Orval_Zod_Code_Injection
{
    meta:
        author = "Valter.SIT Threat Intel"
        description = "Detects template literal injection payloads in generated Zod schema files"
        date = "2026-01-01"
        cve = "CVE-2026-72716"
        cwe = "CWE-1336"
    strings:
        $inline_literal = "return `${" ascii
        $default_payload = ".default(" ascii
        $template_expr = "${" ascii
        $bracket_syntax = "z.string().default(`${" ascii
        $parse_pipe = "| parse(" ascii
        $import_hook = "function formatDefaultValue" ascii
    condition:
        (uint16(0) == 0x0A0D or uint16(0) == 0x0D0A) and
        $template_expr and
        (any of ($inline_literal, $bracket_syntax, $parse_pipe)) and
        filesize < 5MB
}

Suricata IDS Rule

alert http any any -> any any (
    msg:"CVE-2026-72716 - Orval Zod Template Literal Injection Payload in API Spec";
    flow:to_server;
    content:"default"; http.uri;
    content:"${"; http.uri;
    content:".yaml"; http.uri;
    content:".json"; http.uri;
    sid:2026727161;
    rev:1;
    metadata:attack_target Client_Endpoint, created_at 2026_01_01, cve CVE-2026-72716, deployment Perimeter, signature_severity High;
    reference:url, https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-72716;
)

Elastic Detection

sequence by host.name with maxspan=5m
  [process where event.type == "start" and (
     process.name == "npm" or
     process.name == "yarn" or
     process.name == "node" or
     process.name == "npx"
  )]
  [process where event.type == "start" and (
     // Process invocation of orval or related generation tooling
     process.command_line like "*orval*" or
     process.command_line like "*generate*" and
     process.command_line like "*zod*"
  )]

Splunk SPL Query

index=main sourcetype="linux:process"
| where match(CommandLine, "orval") OR match(CommandLine, "zod")
| where match(CommandLine, "\\$\\{")
| table _time, host, user, image, CommandLine
| `ut_parse_args(CommandLine)`
| search ut_args{}.regex="\\$\\{"
| eval is_injection_payload=if(match(CommandLine, "\\.default\\(\\`\\$\\{"), "LIKELY", "SUSPICIOUS")
| rename is_injection_payload as "Injection Likelihood"
| stats count by host, user, image, "Injection Likelihood"

Wazuh OSSEC Rule

<group name="orval,zod,code-injection,">
  <rule id="161295" level="12" frequency="2" timeframe="120">
    <if_sid>5715</if_sid> <!-- Existing rule ID mapping, adjust if needed -->
    <match>orval</match>
    <match>formatDefaultValue</match>
    <match>\$\{</match>
    <description>CVE-2026-72716 - Suspicious template literal expression ${ detected in Orval Zod schema generation</description>
    <group>code_injection,supply_chain,cve_2026_72716,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
    <options>no_full_log</options>
  </rule>

  <rule id="161296" level="10" frequency="1">
    <if_sid>1002716</if_sid>
    <match>z.string().default</match>
    <description>CVE-2026-72716 - Confirmed template literal injection in generated Zod schema parameter default</description>
    <group>code_injection,critical,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No patch evidence from any tracked source at the time of this report. However, the NVD description explicitly states: "This issue is fixed in version 8.21.0."

1. Immediate Mitigations (do these now):

• Upgrade Orval to version 8.21.0 or later. This is the primary and only definitive fix. If your organization has a version-pinning policy, review all lockfiles and update the Orval package. For package.json users: update the orval dependency to ^8.21.0 and regenerate all clients.
• If upgrade is not immediately possible, do NOT generate or import new Zod schemas from untrusted or third-party OpenAPI specifications until the upgrade is complete. Treat all generated Zod modules from prior versions as potentially compromised — especially if generated from third-party or recently modified specs.
• Audit existing generated Zod schema modules in your codebase. Grep for suspicious patterns: ${ within module-level default values of query parameters. Use the Sigma/YARA rules above to scan existing generated code.
• Do not import generated Zod modules into your application, CI, or test environment until either upgraded or audited. If import is unavoidable and you cannot upgrade, the safest approach is to manually inline and remove template-literal expressions from the generated files.

2. Patch/Upgrade Steps:

• Run npm update orval zod or update the pinned version in your package manager of choice to 8.21.0.
• After upgrading, regenerate all clients from the original OpenAPI specs (npx orval generate or your configured CI step).
• Review git diffs of the regenerated files to confirm the previously affected templates no longer contain raw ${...} expressions from default values.
• Verify your CI/CD pipeline now uses the patched version — a common pitfall is one pipeline using an upgraded global npm package while a containerized build uses an older cached image.

3. Long-Term Hardening:

• Treat OpenAPI specifications as untrusted input. Apply the same review rigor to spec changes as you would to source code. Mandate code review for any PR touching *.yaml, *.yml, or *.json that orval consumes.
• Pin specifications to immutable references. Fetch OpenAPI docs from tags/commits rather than mutable branch heads. Use commit hashes in your Orval config file's input URL.
• Fetch specs only over HTTPS with certificate validation enabled and enforce this at the network policy level to prevent MITM substitution.
• Run Orval in an isolated sandbox (container, ephemeral CI runner) with minimal permissions — no cloud credentials, no SSH keys, read-only filesystem where possible.
• Implement code review tooling that flags ${ or backtick characters in OpenAPI spec default values before they enter the generation pipeline.
• Review any spec changes from third-party vendors with extra scrutiny, especially those consumed automatically by CI. A compromised vendor spec is an entry vector for this CVE.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-72716 — Official entry with NVD description confirming Orval versions prior to 8.21.0 are affected, CWE-1336 classification, and the code location packages/zod/src/index.ts function formatDefaultValue.

2. Orval npm Package: https://www.npmjs.com/package/orval — Contains version history; version 8.21.0 is the patched version per the NVD description. Verify your installed version here.

3. Orval GitHub Repository: https://github.com/anymaniax/orval — Source code for Orval; packages/zod/src/index.ts is the vulnerability location. Monitor for official advisory and release notes for 8.21.0.

4. MITRE ATT&CK — T1190 Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/ — Relevant framework mapping for exploitation of publicly accessible/consumed specifications and services.

5. CISA KEV (Known Exploited Vulnerabilities) Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — As of this report, CVE-2026-72716 is NOT listed in the KEV catalog ("CISA KEV: NO"). Organizations should re-check this catalog periodically for updates. No known threat actor campaigns or exploit-in-the-wild evidence for this CVE has been publicly documented as of the report date. Continuous monitoring is advised, as supply-chain code-execution vulnerabilities of this type are frequently weaponized after public disclosure.