CVE-2026-72716

Orval (a TypeScript client generator from OpenAPI/Swagger specs) prior to 8.21.0 is vulnerable to import-time remote code execution . The root cause is in packages/zod/src/index.ts, function formatDefaultValue: a ${...} expression or backtick in a query parameter default is emitted into a module-...

CVE-2026-72716 Orval: Import-time RCE via query-parameter default -> zod module-level template literal

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a $... expression or backtick in a query parameter default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permit...

CVE-2026-72716 Orval: Import-time RCE via query-parameter default -> zod module-level template literal

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a $... expression or backtick in a query parameter default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permit...

CVE-2026-62681 Orval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout)

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, an unescaped backtick in an OpenAPI path is emitted into request URL template literals generated for axios, fetch, react-query, and SWR clients without safe encoding. This...

CVE-2026-62681

In Orval

CVE-2026-62681 Orval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout)

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, an unescaped backtick in an OpenAPI path is emitted into request URL template literals generated for axios, fetch, react-query, and SWR clients without safe encoding. This...

CVE-2026-71866 Orval: Import-time RCE via schema property name -> computed-property-key injection in the zod client

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. From version 8.19.0 until 8.21.0, a double quote in a schema property name is emitted into the generated zod.object... schema without safe encoding. This permits attacker-controlled JavaScrip...

CVE-2026-71866 Orval: Import-time RCE via schema property name -> computed-property-key injection in the zod client

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. From version 8.19.0 until 8.21.0, a double quote in a schema property name is emitted into the generated zod.object... schema without safe encoding. This permits attacker-controlled JavaScrip...

CVE-2026-71866

Orval is a tool that generates type-safe TypeScript clients from OpenAPI v3 and Swagger v2 specifications. Versions 8.19.0 through 8.21.0 are affected by an import-time remote code execution vulnerability caused by a double quote in a schema property name being emitted into the generated zod.obje...

PT-2026-78550

Name of the Vulnerable Software and Affected Versions Orval versions 8.19.0 through 8.20.x Description Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. A double quote in a schema property name is emitted into the generated zod.object...

PT-2026-78554

Name of the Vulnerable Software and Affected Versions Orval versions prior to 8.21.0 Description Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. A flaw exists where a $... expression or backtick in a header parameter default is emitted int...

PT-2026-78544

Name of the Vulnerable Software and Affected Versions Orval versions prior to 8.22.0 Description Orval resolves remote and local external $ref values without an allowlist or confinement to the input directory. Processing an attacker-controlled OpenAPI description can lead to requests from the...

PT-2026-78546

Name of the Vulnerable Software and Affected Versions Orval versions prior to 8.21.0 Description An unescaped backtick in servers0.url is emitted into request URL template literals when output.baseUrl.getBaseUrlFromSpecification is enabled without safe encoding. This allows attacker-controlled...

PT-2026-78555

Name of the Vulnerable Software and Affected Versions Orval versions prior to 8.21.0 Description Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. A flaw exists where a $... expression or backtick in a query parameter default is emitted into...

PT-2026-78545

Name of the Vulnerable Software and Affected Versions Orval versions prior to 8.21.0 Description An issue exists where unescaped backticks in an OpenAPI path are emitted into request URL template literals for axios, fetch, react-query, and SWR clients without safe encoding. This allows...

PT-2026-78551

Name of the Vulnerable Software and Affected Versions Orval versions prior to 8.21.0 Description Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. A flaw exists where a single quote in a schema property name is emitted into single-quoted...

PT-2026-78556

Name of the Vulnerable Software and Affected Versions Orval versions prior to 8.21.0 Description Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. A flaw exists where a $... expression or backtick in a schema default is emitted into a...

PT-2026-78548

Name of the Vulnerable Software and Affected Versions Orval versions prior to 8.21.0 Description Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. A double quote in a header parameter name is emitted into the generated request-validation...

PT-2026-78553

Name of the Vulnerable Software and Affected Versions Orval versions prior to 8.21.0 Description Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. A flaw exists where a $... expression or backtick in an array item default is emitted into a...

PT-2026-78549

Name of the Vulnerable Software and Affected Versions Orval versions prior to 8.21.0 Description Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. A double quote in a query parameter name is emitted into the generated request-validation...