CVE-2026-72717

Executive Summary

CVE-2026-72717 is a code injection vulnerability in Orval, a widely used tool that generates type-safe JavaScript clients from OpenAPI v3 and Swagger v2 specifications. Versions prior to 8.21.0 fail to safely encode ${...} expressions or backtick characters found in schema definitions when emitting zod schema modules, allowing an attacker who controls or influences an OpenAPI/Swagger specification to inject arbitrary JavaScript code. This code executes when a developer, CI pipeline, test suite, or application imports the generated zod schema module, resulting in remote code execution in the context of the importing process. The vulnerability is fixed in version 8.21.0.

Technical Analysis

The vulnerability resides in the Orval code generation pipeline, specifically in the packages/zod/src/index.ts file, within the formatDefaultValue function. This function is responsible for formatting default values extracted from OpenAPI v3 or Swagger v2 schema definitions into the generated TypeScript/zod output.

The core flaw is a lack of proper sanitization or encoding of certain JavaScript template literal syntax. When a schema definition contains a default value that includes either:

1. A ${...} expression — the standard JavaScript template literal interpolation syntax
2. A backtick character (`) — the delimiter used to define template literals in JavaScript

The formatDefaultValue function emits this content directly into a module-level template literal within the generated zod schema file. Because the content is not safely encoded or escaped, the injected expression becomes part of the generated JavaScript code itself.

The attack mechanism works as follows:

1. An attacker crafts (or manipulates) an OpenAPI or Swagger specification that includes a schema property with a malicious default value containing a JavaScript expression such as ${process.mainModule.require('child_process').execSync('malicious_command')}.

2. Orval processes this specification and generates a zod schema module. The formatDefaultValue function copies the malicious expression verbatim into the generated code's template literal.

3. When any consumer imports the generated zod schema module (in a development environment, CI pipeline, test suite, or production application), the TypeScript/JavaScript runtime evaluates the template literal at module load time. The embedded expression executes with the privileges of the importing process.

This is a supply-chain-adjacent attack vector: the malicious code does not execute at generation time, but rather at import time in any environment that uses the generated files. The attack surface includes any developer workstation, CI/CD runner, test environment, or production server that imports a zod schema generated from a compromised or malicious OpenAPI specification.

The root cause is classified as CWE-94 (Improper Control of Generation of Code — "Code Injection"), as the tool generates code containing untrusted input without adequate sanitization.

Exploitation Scenarios

Reconnaissance and Target Identification

An attacker seeks to compromise developers, build pipelines, or applications that use Orval to generate TypeScript clients and zod schemas from OpenAPI/Swagger specifications. Targets include:

• Software development teams whose repositories incorporate Orval in their build process
• Organizations that consume third-party OpenAPI specifications (e.g., from API providers, vendors, or open-source projects)
• CI/CD pipelines where code generation runs automatically on committed specification changes

The attacker may also leverage social engineering or direct supply-chain manipulation to get a malicious spec committed to a target repository.

Triggering the Vulnerability

The attacker must introduce a malicious OpenAPI/Swagger specification into the target's codebase. This can occur through:

1. Direct contribution — submitting a pull request that modifies or adds an OpenAPI spec containing malicious schema defaults
2. Dependency compromise — a legitimate upstream API provider's spec is modified, or the attacker controls a spec that the target fetches dynamically
3. Repository compromise — the attacker gains write access to the target repository

The malicious schema default must contain either a ${...} expression or a backtick that will be emitted into the generated zod module without encoding.

Payload and Execution Method

The payload is embedded in the default value of a schema property. When Orval generates the zod schema module, the payload is emitted into the module-level template literal. The attacker can use standard JavaScript expression syntax to achieve arbitrary code execution, such as:

• Invoking process.mainModule or require() to access Node.js internals
• Using child_process to execute OS commands
• Reading or exfiltrating environment variables, secrets, or source code
• Establishing reverse shells or persistence mechanisms

The payload executes on any system that imports the generated module. In a CI environment, this happens during build or test steps. In a developer environment, this occurs whenever the developer runs a build, test, or linting command that loads the module. In production, this occurs if the generated zod schema is part of the runtime application.

Post-Exploitation Impact

Once code execution is achieved, the attacker can:

• Steal credentials, API keys, or secrets from the compromised environment
• Modify source code or generated artifacts to introduce backdoors
• Escalate privileges within the CI/CD pipeline
• Pivot to other systems accessible from the compromised environment

No public PoC is available for CVE-2026-72717; this attack chain is inferred from the vulnerability class (code injection via template literal interpolation) and the NVD description.

Impact Assessment

Affected Systems: Any system that executes code generated by Orval versions prior to 8.21.0. This includes developer workstations, CI/CD pipelines, test environments, and potentially production deployments where generated zod schemas are used at runtime.

Business Impact:

• Confidentiality: High — attacker-controlled code can exfiltrate source code, secrets, environment variables, and customer data from any environment that imports the malicious generated module.
• Integrity: High — an attacker can modify build artifacts, inject backdoors into shipped code, or tamper with application logic.
• Availability: High — arbitrary code execution can lead to system destruction, data deletion, or denial of service.

Blast Radius: The vulnerability propagates through generated artifacts. A single malicious OpenAPI spec can compromise every environment that regenerates and imports from it. In teams where code generation is shared via a central repository or service, the blast radius expands to all downstream consumers of the generated code.

CVSS Assessment: No CVSS score has been assigned (N/A). Based on the vulnerability class, a reasonable estimate would place this in the High severity range (likely 8–9) given the remote code execution capability, but without an official score, this remains an estimate. The attack requires the attacker to influence an OpenAPI specification that the target processes — a nontrivial precondition that lowers the unauthenticated attack surface but still represents a serious supply-chain risk.

Detection Guidance

Sigma Rule

title: Orval Zod Schema Generation Code Injection via Malicious Default Values
id: 3a5f1c9e-8d42-4b7a-b1f0-6c9e2d4a8a11
status: experimental
description: Detects suspicious default values in OpenAPI/Swagger files that may contain JavaScript template literal injection leading to code execution via Orval's zod schema generation.
author: Valtersit Threat Intelligence
logsource:
    product: generic
    service: development
detection:
    selection_defaults:
        - field: openapi_schema_default
          contains|any:
            - '${'
            - '`'
    selection_process_execution:
        - field: process_command_line
          contains|any:
            - 'node'
            - 'orval'
            - 'ts-node'
            - 'jest'
    condition: selection_defaults and selection_process_execution
level: high
falsepositives:
    - Legitimate use of template literal syntax in schema defaults by API specification authors
tags:
    - attack.t1204.001
    - cve.2026.72717
    - cwe.94

YARA Rule

rule CVE_2026_72717_Orval_Zod_Injection
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects OpenAPI/Swagger schema files containing malicious default values targeting Orval zod schema generation"
        cve = "CVE-2026-72717"
        date = "2026-04-15"
        severity = "high"
    strings:
        $template_literal_expr = /default.*?\$\{.*?\}/ ascii nocase
        $backtick = /default.*?`/ ascii nocase
        $node_require = /require\s*\(/ ascii nocase
        $child_process = /child_process/ ascii nocase
        $process_env = /process\.env/ ascii nocase
        $exec_calls = /(execSync|exec|spawn|eval)\s*\(/ ascii nocase
    condition:
        ($template_literal_expr or $backtick) and 2 of ($node_require, $child_process, $process_env, $exec_calls)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-72717 Orval Zod Schema Code Injection Attempt"; flow:established,to_server; content:"openapi"; nocase; http_uri; content:"3.0"; nocase; http_uri; content:"default"; nocase; http_client_body; pcre:"/default\s*:\s*[\"']\$\{[^\"']*\}/Ui"; sid:202672717; rev:1; metadata:attack_target Client_Endpoint, created_at 2026_04_15, cve CVE_2026_72717, deployment Perimeter, signature_severity Critical, tag Code_Injection;)

Elastic Detection

sequence by process.entity_id with maxspan=1m
  [process where event.action == "start" and
     (process.name in ("node", "ts-node", "npm", "yarn", "pnpm") or
      process.name in ("jest", "mocha", "vitest")) and
     process.args : ("*orval*", "*generate*")]
  [file where event.action == "write" and
     file.extension == "ts" and
     file.path : "*zod*" and
     process.name in ("node", "ts-node", "npm", "yarn", "pnpm")]
  [process where event.action == "start" and
     process.parent.name in ("node", "ts-node", "npm", "yarn", "pnpm") and
     process.command_line : ("*child_process*", "*exec*", "*spawn*", "*curl*", "*wget*")]

Splunk SPL Query

index=* (source="*openapi*" OR source="*swagger*" OR sourcetype="json")
    | regex _raw="default.*\$\{.*\}"
    | rex field=_raw "default.*?[\"'](?<payload>\$\{.*?\})[\"']"
    | eval has_malicious_pattern=if(match(payload, "(?i)(child_process|execSync|exec\(|spawn\(|eval\(|process\.env|require\()"), "true", "false")
    | where has_malicious_pattern="true"
    | table _time, host, source, payload
    | sort -_time

Wazuh OSSEC Rule

<group name="cve-2026-72717,">
  <rule id="568504" level="12">
    <if_sid>550</if_sid>
    <regex>default.*\$\{.*\}</regex>
    <regex on="end">default.*`</regex>
    <description>CVE-2026-72717: Potential Orval zod schema code injection detected - suspicious template literal in schema default value</description>
    <group>code_injection,cve_2026_72717,orval,</group>
    <mitre>
      <id>T1204.001</id>
    </mitre>
  </rule>

  <rule id="568505" level="15">
    <if_sid>2026717</if_sid>
    <regex>(child_process|execSync|exec\s*\(|spawn\s*\(|eval\s*\(|process\.env|require\s*\()</regex>
    <description>CVE-2026-72717: Malicious JavaScript execution primitives detected in schema default value - high confidence of exploitation attempt</description>
    <group>code_injection,cve_2026_72717,orval,</group>
    <mitre>
      <id>T1204.001</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED (no patch evidence from tracked sources; however, the NVD description confirms the issue is fixed in version 8.21.0).

1. Immediate Mitigations:

• Upgrade Orval: Upgrade to version 8.21.0 or later immediately. This is the only confirmed fix.
• Review OpenAPI/Swagger specifications: Audit all specifications used in your code generation pipelines for the presence of ${...} expressions or backtick characters in schema default values. Flag and remove any such content.
• Restrict third-party spec sources: Only process OpenAPI/Swagger specifications from trusted, verified sources. Implement a review process for any specification changes before they enter your build pipeline.
• Run code generation in isolated sandboxes: Execute Orval in a containerized or sandboxed environment with minimal privileges and no access to production secrets or credentials.
• Manual inspection of generated output: Until the upgrade is complete, manually inspect generated zod schema modules for unexpected template literal content before committing the generated code to your repository.

2. Patch/Upgrade Steps:

1. Verify your current Orval version: npm list orval or check your package.json
2. Upgrade to the patched version: npm install orval@^8.21.0 (or equivalent for yarn/pnpm)
3. Regenerate all client code and zod schemas from your specifications
4. Review the diff in generated files for any behavioral changes
5. Run full test suite and CI pipeline to confirm compatibility

3. Long-Term Hardening:

• Supply-chain security: Implement software composition analysis (SCA) in your CI pipeline to detect vulnerable dependencies, including development-time tools like Orval.
• Specification integrity: Sign or hash OpenAPI/Swagger specifications when they come from external sources; verify signatures before processing.
• Code generation governance: Treat code generators as a trusted build component. Pin exact versions, use lockfiles, and automatically scan for known vulnerabilities in development dependencies.
• Runtime monitoring: Monitor for unexpected child process execution, network connections, or file modifications in build environments.
• Least-privilege CI: Ensure CI/CD runners have the minimum permissions required for their function. Build environments should not have access to production credentials or secrets.
• Developer awareness: Educate developers on the risks of processing untrusted specifications and the importance of reviewing generated code diffs.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-72717
2. Orval GitHub Repository: https://github.com/anymaniax/orval
3. Orval Releases (for version 8.21.0 patch notes): https://github.com/anymaniax/orval/releases
4. CWE-94 — Improper Control of Generation of Code: https://cwe.mitre.org/data/definitions/94.html
5. MITRE ATT&CK — T1204.001 User Execution: Malicious Link: https://attack.mitre.org/techniques/T1204/001/

Threat Actor Activity: No known in-the-wild exploitation campaigns have been reported for CVE-2026-72717. The CVE is not listed in CISA's Known Exploited Vulnerabilities catalog. The vulnerability is classified as a code injection issue in a development tool, making it most likely to be exploited in supply-chain attack scenarios targeting developer environments and CI/CD pipelines.