CVE-2026-72716: Orval Critical RCE Vulnerability via Unescaped Query Parameter Default
Summary
CVE-2026-72716: Orval: Import-time RCE via query-parameter default -> zod module-level template literal. Affects orval versions < 8.21.0. Fixed in 8.21.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Orval is an open-source tool designed for generating TypeScript clients from OpenAPI specifications. It simplifies the process of creating API clients by automating the generation of TypeScript code based on the API definitions. However, a critical vulnerability has been identified in version 8.19.0, which allows for remote code execution (RCE) due to improper handling of query parameter defaults.
Vulnerability Detail
The vulnerability arises from Orval's zod schema generation, which emits the query parameter 'default' value as a module-level template literal without escaping. This allows an attacker to inject a live JavaScript expression into the generated zod schema module. When the module is imported, the injected code is executed, leading to potential remote code execution. The issue is particularly severe as it does not require any request or function call to trigger the execution, making it a critical security concern.
How To Fix
Latest published version: 8.44.0 as of 22 Oct 2026
npm install orval@8.44.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
8.21.0
This is the first release that contains the fix.
npm install orval@8.21.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using query parameters with default values that could be influenced by user input. Ensure that any OpenAPI specifications used to generate zod schemas are sanitized and do not contain untrusted data.
Conclusion
In summary, the Orval package has a critical vulnerability (CVE-2026-72716) that allows for remote code execution through unescaped query parameter defaults. It is essential to update to version 8.21.0 or later to mitigate this risk. Additionally, using Vulert can help you monitor for such vulnerabilities in your applications.
See every vulnerability recorded for orval →
FAQ
The CVSS score of this vulnerability is 9.3, indicating a critical severity level.
The vulnerability affects Orval version 8.19.0 and earlier. It is fixed in version 8.21.0.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If you cannot update immediately, avoid using untrusted input for query parameter defaults and sanitize your OpenAPI specifications.
Vulert is a tool that monitors and alerts in real-time for open-source vulnerabilities in your software using just package-lock.json. It helps you stay informed about potential security issues.
References
Related vulnerabilities
Recent vulnerabilities recorded for orval.
