NPM: Orval: Import-time RCE via header parameter name -> computed-property-key injection in the zod client

NPM: Orval: Import-time RCE via header parameter name - computed-property-key injection in the zod client vulnerability discovered by ? in WordPress Npm orval versions 8.21.0...

CVE-2026-71864 Orval: Import-time RCE via header parameter name -> computed-property-key injection in the zod client

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a double quote in a header parameter name is emitted into the generated request-validation zod.object... schema without safe encoding. This permits attacker-controlled...

CVE-2026-71864 Orval: Import-time RCE via header parameter name -> computed-property-key injection in the zod client

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a double quote in a header parameter name is emitted into the generated request-validation zod.object... schema without safe encoding. This permits attacker-controlled...