TI-2026-50187 Aliases CVE-2026-71866 GHSA-6mr6-jvcr-2f25

Orval: Import-time RCE via schema property name -> computed-property-key injection in the zod client

HIGH 81CWE-89Published 2026-08-19 · Updated 2026-08-19

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: SQL injection, Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-89 and CWE-95.

Summary

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. From version 8.19.0 until 8.21.0, a double quote in a schema property name is emitted into the generated zod.object({...}) schema without safe encoding. This permits attacker-controlled JavaScript to be evaluated when the generated zod schema module is imported, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/zod/src/index.ts and zod object-key generation. This issue is fixed in version 8.21.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00653 51st percentileScored 2026-11-07

Fix Fixed orval (orval-labs): 8.21.0orval (npm): 8.21.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
orval-labs	orval	before 8.21.0	8.21.0	Patch available	CNA
—	orval (npm)	before 8.21.0	8.21.0	Patch available	GHSA-6mr6-jvcr-2f25

orval Vendororval-labs Affected before 8.21.0 Fixed in 8.21.0 Patch available CNA
orval (npm) Vendor— Affected before 8.21.0 Fixed in 8.21.0 Patch available GHSA-6mr6-jvcr-2f25

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:orval:orval::::::::	—	—	orval-labs

cpe:2.3:a:orval:orval:*:*:*:*:*:*:*:* Versions — — ·orval-labs

Remediation

Fix · CNA orval (orval-labs) Fixed in 8.21.0
Fix · GHSA-6mr6-jvcr-2f25 orval (npm) Fixed in 8.21.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-71866
2026-10-03 Alias added: GHSA-6mr6-jvcr-2f25
2026-10-14 EPSS moved to the 50th–90th percentile

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-71866

Other 5

TI-2026-63855 orval before 8.29.0 Code Injection via operationId CVSS 4.0CRITICAL 9.3
TI-2026-63854 orval @orval/core before 8.28.0 Code Injection via Form-Data CVSS 4.0CRITICAL 9.3
TI-2026-63853 orval before 8.29.0 Code Injection via unescaped OpenAPI media-type CVSS 4.0CRITICAL 9.3
TI-2026-63850 orval @orval/hono before 8.29.0 Code Injection via OpenAPI Path CVSS 4.0CRITICAL 9.3
TI-2026-50952 Orval: Import-time RCE via schema default -> zod module-level template literal CVSS 4.0CRITICAL 9.3
TI-2026-50951 Orval: Import-time RCE via query-parameter default -> zod module-level template literal CVSS 4.0CRITICAL 9.3

See all 21 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences