@testurio/cli (>=0.6.3, <=0.7.3) potentially affected by CVE-2026-71866 via orval (8.5.3)

orval NPM version 8.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on orval and may be impacted: - @testurio/cli =0.6.3, =0.7.3 Source cves: CVE-2026-71866 Source advisory: OSV:GHSA-6MR6-JVCR-2F25...

CVE-2026-71866

creationtimestamp| type| source ---|---|--- 2026-08-19 20:10:33+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mthjzhs6lx2e 2026-08-20 00:10:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mthxfrxthy25 2026-09-02 16:35:20+00:00| published-proof-of-concept|...

CVE-2026-71866 Orval: Import-time RCE via schema property name -> computed-property-key injection in the zod client

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. From version 8.19.0 until 8.21.0, a double quote in a schema property name is emitted into the generated zod.object... schema without safe encoding. This permits attacker-controlled JavaScrip...