CVE-2026-71866: Orval Package Suffers from Import-Time RCE via Schema Property Name Injection
Summary
CVE-2026-71866: Orval: Import-time RCE via schema property name -> computed-property-key injection in the zod client. Affects orval versions < 8.21.0. Fixed in 8.21.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Orval is an open-source tool designed for generating TypeScript clients from OpenAPI specifications. It leverages the Zod library for schema validation, enabling developers to create robust and type-safe API clients. However, a critical vulnerability has been identified in the Zod client of Orval, which can lead to remote code execution (RCE) during module import.
Vulnerability Detail
The vulnerability arises from the way Orval's Zod client generates object schemas. Specifically, it emits schema property names as double-quoted keys without escaping double quotes. This oversight allows an attacker to inject a computed property key into the object literal, which gets evaluated at module import time. As a result, malicious code can be executed when the module is imported, leading to potential JavaScript or OS command execution. This vulnerability has been verified in version 8.19.0 of Orval and is classified under CWE-94 (Improper Control of Generation of Code) and CWE-95 (Improper Neutralization of Special Elements in Output Used by a Downstream Component).
How To Fix
Latest published version: 8.44.0 as of 22 Oct 2026
npm install orval@8.44.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
8.21.0
This is the first release that contains the fix.
npm install orval@8.21.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using property names that contain double quotes in the schema definitions. Additionally, ensure that any schemas generated from untrusted sources are reviewed and sanitized before use.
Conclusion
The vulnerability CVE-2026-71866 in the Orval package poses a significant risk due to its potential for remote code execution at import time. It is crucial for developers using Orval to update to the patched version 8.21.0 and to implement best practices for schema management to mitigate risks.
See every vulnerability recorded for orval →
FAQ
CVE-2026-71866 is a critical vulnerability in the Orval package that allows for remote code execution during module import due to improper handling of schema property names.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score for this vulnerability is 9.3, indicating a critical level of severity.
If an immediate update is not possible, consider implementing the suggested workaround by avoiding property names with double quotes and reviewing schemas from untrusted sources.
You can find more information about Orval and its features on its official GitHub repository or documentation pages.
References
Related vulnerabilities
Recent vulnerabilities recorded for orval.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
