Monitor vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.3

Orval generates malicious JavaScript when using double quotes in headers

CVE-2026-71864 · published 4 days ago
Summary

A security issue in Orval's generated code could allow attackers to execute code on a developer's machine. This happens when a header parameter name contains a double quote, which can lead to malicious code being evaluated. To fix this, update to version 8.21.0 or later.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
orval-labs orval < 8.21.0
Original advisory text
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a double quote in a header parameter name is emitted into the generated re...
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a double quote in a header parameter name is emitted into the generated request-validation zod.object({...}) schema without safe encoding. This permits attacker-controlled JavaScript to be evaluated when the generated zod schema module is imported, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/zod/src/index.ts and header request-validation generation. This issue is fixed in version 8.21.0.
References
Severity
9.3 Critical
Exploitation
EPSS <1%
Type
CWE-94Code Injection
CWE-95
CWE-116
Timeline
Published19 Aug 2026
Updated20 Aug 2026
First seen19 Aug 2026
Sources
CVE-2026-71864 · NVD
CVE-2026-71864 · MITRE
Monitor software like this
Free during beta