CVE-2026-71864: Orval: Import-time RCE via header parameter name -> computed-property-key injection in the zod client
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a double quote in a header parameter name is emitted into the generated request-validation zod.object({...}) schema without safe encoding. This permits attacker-controlled JavaScript to be evaluated when the generated zod schema module is imported, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/zod/src/index.ts and header request-validation generation. This issue is fixed in version 8.21.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Orvalto a version that resolves this vulnerability.Fixed in 8.21.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of Orval versions before 8.21.0 are exposed when they generate a Zod client from an OpenAPI v3 or Swagger v2 specification containing an attacker-controlled header parameter name. The generated schema can execute code when it is imported in a developer workstation, CI, test, or application environment.
What must an attacker control to exploit it?
An attacker needs to supply or influence an API specification with a header parameter name containing a double quote. That value is emitted without safe encoding into the generated request-validation Zod schema.
How can I remediate the issue?
Upgrade Orval to version 8.21.0, which fixes header request-validation generation in packages/zod/src/index.ts. Regenerate affected Zod clients after upgrading.