Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.9

Orval generated Zod schema can run code on import

CVE-2026-72717 · published 25 days ago
Summary

If an application imports a Zod schema file created by Orval, a specially crafted default value can cause JavaScript code to run automatically. This can happen when the OpenAPI description used to generate the schema is controlled or influenced by an attacker. Update Orval to a version that properly escapes default values or avoid importing generated schemas from untrusted sources.

What to do
  • Update melloware orval to version 8.21.0.
  • Update orval to version 7.21.0-aikido.1.
  • Update rootio @rootio/orval to version 7.21.0-root.io.1.
  • Update orval to version 7.13.2-aikido.2.
  • Update rootio @rootio/orval to version 7.13.2-root.io.2.
  • Update orval to version 7.21.0-aikido.2.
  • Update rootio @rootio/orval to version 7.21.0-root.io.2.
  • Update orval to version 8.21.0.
  • Update orval to version 7.21.0-aikido.3.
  • Update rootio @rootio/orval to version 7.21.0-root.io.3.
Affected software
Ecosystem VendorProductAffected versions
npm melloware orval < 8.21.0
Fix: upgrade to 8.21.0
– orval-labs orval < 8.21.0
Root:npm – orval < 7.21.0-aikido.1
< 7.13.2-aikido.2
< 7.21.0-aikido.2
< 7.21.0-aikido.3
Fix: upgrade to 7.21.0-aikido.1
Root:npm rootio @rootio/orval < 7.21.0-root.io.1
< 7.13.2-root.io.2
< 7.21.0-root.io.2
< 7.21.0-root.io.3
Fix: upgrade to 7.21.0-root.io.1
npm – orval < 8.21.0
Fix: upgrade to 8.21.0
Original advisory text
Orval: Import-time RCE via schema default -> zod module-level template literal
### Summary

Orval's zod schema generation emits a schema's `default` value as a module-level template literal (`export const …Default = `<default>`;`) without escaping `${` or the backtick. A default of the form `v${<code>}w` injects a live JavaScript expression that is evaluated when the generated zod schema module is imported, executing attacker-controlled code at import — no request or function call needed. Verified on Orval 8.19.0; survives default OpenAPI validation.

### Details

```ts
export const getIResponseDsDefault = `v${globalThis.ORVPWN()}w`;
```

`${...}` permits an arbitrary JS expression. Orval escapes its other value sinks (enum, mock, regex, object-default values) with `\'` inside single-quoted strings; the string `default` is the one value emitted as a backtick template literal, so `${...}`/backtick are interpreted, not escaped. Distinct from the URL-template-literal cases (different field and sink) and from the published Orval CVEs (summary/MCP, x-enumDescriptions, const/mock).

### PoC

`reproduce.sh` (+ `make_spec.py`) attached: generates the zod schema with default validation, bundles it, imports it, and shows a marker written at import. Verified on 8.19.0.

### Impact

Code execution at import in any application that imports a zod schema module generated from an attacker-controlled or attacker-influenced OpenAPI description.

### Suggested fix

Emit `default` values via a proper string-literal encoder (JSON.stringify, or escape backtick and ${ if a template literal must be used); never interpolate a spec value into a template literal.

[maintainer-report.txt](https://github.com/user-attachments/files/29399048/maintainer-report.txt)
[make_spec.py](https://github.com/user-attachments/files/29399049/make_spec.py)
[reproduce.sh](https://github.com/user-attachments/files/29399050/reproduce.sh)
References
Severity
9.9 Critical
CVSS 4.0: 9.9 (OSV)
Exploitation
EPSS <1%
Type
CWE-94Code Injection
CWE-116Improper Encoding or Escaping of Output
CWE-1336Improper Neutralization of Special Elements Used in a Template Engine
Timeline
Published3 Sep 2026
Updated27 Sep 2026
First seen19 Aug 2026
Sources
GHSA-w727-8j6c-2rj4 · GHSA
CVE-2026-72717 · OSV
CVE-2026-72717 · NVD
CVE-2026-72717 · MITRE
GHSA-w727-8j6c-2rj4 · OSV
ROOT-APP-NPM-CVE-2026-72717 · OSV
Track software like this
Free during beta