CVE-2026-71866: Orval: Import-time RCE via schema property name -> computed-property-key injection in the zod client
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. From version 8.19.0 until 8.21.0, a double quote in a schema property name is emitted into the generated zod.object({...}) schema without safe encoding. This permits attacker-controlled JavaScript to be evaluated when the generated zod schema module is imported, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/zod/src/index.ts and zod object-key generation. This issue is fixed in version 8.21.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
orvalto a version that resolves this vulnerability.Fixed in 8.21.0
Event History
Frequently Asked Questions
Which environments are at risk?
Any developer workstation, CI job, test environment, or application environment that imports a generated Zod schema module can execute the injected JavaScript. Exposure requires generating the client from an attacker-controlled OpenAPI or Swagger specification.
What does an attacker need to control?
The attacker needs to supply or modify an API specification with a schema property name containing a double quote. The payload is evaluated when the generated Zod schema module is imported.
How can I determine whether my workflow is affected?
Check whether Orval versions from 8.19.0 up to, but not including, 8.21.0 were used to generate Zod clients. Workflows that generate or import Zod schemas from untrusted or externally supplied specifications are the relevant exposure path.
What should be done if upgrading cannot happen immediately?
Do not generate or import Zod schema clients from untrusted API specifications. Upgrade Orval to version 8.21.0 when possible, then regenerate affected clients.