CVE-2026-71866: Orval: Import-time RCE via schema property name -> computed-property-key injection in the zod client
Summary
orval's zod client emits each schema property name as a double-quoted key in the generated zod.object({...}) WITHOUT escaping the double quote. A " in a property name closes the key and lands in object-literal context, where an injected computed property key [expr] is evaluated when zod.object({...}) runs -- which is at MODULE IMPORT (the export const X = zod.object({...}) executes on load) -> import-time RCE. The property name is a pure data field. Verified on orval 8.19.0 / Node. CWE-94 / CWE-95 / CWE-116.
Details
ts export const OpBody = zod.object({ "a":zod.string(),[require("fs").writeFileSync("PWNED","")]:zod.string(),"b": zod.string().optional() })
Sibling: the MSW mock uses a single-quoted key (' breakout, call-time) -- separate report. The TS interface key is a type (DoS only). Distinct from orval's $ref / route-path / server-url / zod-default findings.
PoC
reproduce.sh (+ makespec.py) attached: a property name a":zod.string(),[require("fs").writeFileSync("<marker>","")]:zod.string(),"b -> zod.object; evaluating it (= importing the module) writes the marker. Verified on 8.19.0.
Impact
JavaScript / OS command execution (via childprocess) at import time for anyone who generates an orval zod client from an attacker-controlled spec and imports it. Estimated Critical, e.g. CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N.
Suggested fix
Escape the property name for the JS string key (JSON.stringify) in the zod.object key generation; never interpolate a raw property name adjacent to [ ] in object-literal position. maintainer-report.txt makespec.py reproduce.sh
Other sources
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. From version 8.19.0 until 8.21.0, a double quote in a schema property name is emitted into the generated zod.object({...}) schema without safe encoding. This permits attacker-controlled JavaScript to be evaluated when the generated zod schema module is imported, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/zod/src/index.ts and zod object-key generation. This issue is fixed in version 8.21.0.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/orvalto a version that resolves this vulnerability.Fixed in 8.21.0 - Upgrade
Upgrade
orval/zod client generator (packages/zod)to a version that resolves this vulnerability.Fixed in 8.21.0 - Configuration
In the zod.object({...}) generation logic in packages/zod/src/index.ts, escape schema property names when emitting them as JavaScript object-literal keys (e.g., by using JSON.stringify for the key) so that any double quotes in property names are never emitted unescaped into the generated zod.object({...}) module.
packages/zod/src/index.ts (zod.object key generation) computed-property-key injection handling via JS string key escaping = Use JSON.stringify escaping for the generated object literal keys (escape double quotes in schema property names)
Event History
Frequently Asked Questions
Which environments are at risk?
Any developer workstation, CI job, test environment, or application environment that imports a generated Zod schema module can execute the injected JavaScript. Exposure requires generating the client from an attacker-controlled OpenAPI or Swagger specification.
What does an attacker need to control?
The attacker needs to supply or modify an API specification with a schema property name containing a double quote. The payload is evaluated when the generated Zod schema module is imported.
How can I determine whether my workflow is affected?
Check whether Orval versions from 8.19.0 up to, but not including, 8.21.0 were used to generate Zod clients. Workflows that generate or import Zod schemas from untrusted or externally supplied specifications are the relevant exposure path.
What should be done if upgrading cannot happen immediately?
Do not generate or import Zod schema clients from untrusted API specifications. Upgrade Orval to version 8.21.0 when possible, then regenerate affected clients.