CVE-2026-71867

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a single quote in a schema property name is emitted into single-quoted object keys in generated MSW mock factories without safe encoding. This permits attacker-controlled...

CVE-2026-71871 Orval: Import-time RCE via header-parameter default -> zod module-level template literal

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a $... expression or backtick in a header parameter default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permi...

PT-2026-78545

Name of the Vulnerable Software and Affected Versions Orval versions prior to 8.21.0 Description An issue exists where unescaped backticks in an OpenAPI path are emitted into request URL template literals for axios, fetch, react-query, and SWR clients without safe encoding. This allows...