CVE-2026-72717

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a $... expression or backtick in a schema default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permits...

CVE-2026-71868

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a $... expression or backtick in an enum default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permits...

CVE-2026-72717

CVE-2026-72717 is a critical (CVSS 4.0: 9.3 ) import-time remote code execution vulnerability in Orval , a tool that generates type-safe TypeScript clients from OpenAPI/Swagger specifications. The root cause is in packages/zod/src/index.ts, function formatDefaultValue: a ${...} expression or back...

CVE-2026-72717 Orval: Import-time RCE via schema default -> zod module-level template literal

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a $... expression or backtick in a schema default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permits...

EUVD-2026-62605

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a $... expression or backtick in an enum default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permits...

EUVD-2026-62603

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a $... expression or backtick in an array item default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permits...

CVE-2026-71871 Orval: Import-time RCE via header-parameter default -> zod module-level template literal

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a $... expression or backtick in a header parameter default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permi...

CVE-2026-71871 Orval: Import-time RCE via header-parameter default -> zod module-level template literal

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a $... expression or backtick in a header parameter default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permi...

CVE-2026-71866 Orval: Import-time RCE via schema property name -> computed-property-key injection in the zod client

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. From version 8.19.0 until 8.21.0, a double quote in a schema property name is emitted into the generated zod.object... schema without safe encoding. This permits attacker-controlled JavaScrip...

PT-2026-78556

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a $... expression or backtick in a schema default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permits...

Tool Calling in Spring AI 2.0: A Composable, Agentic Architecture

Tool calling — the ability for an AI model to invoke application-defined functions and act on the results — is the essential building block of agentic AI systems. A model that can discover information, take action, and loop until a goal is reached is an agent. Spring AI 2.0 rearchitects tool...

Spring Data JDBC - How To Maintain Your Database Schema

This is the fifth article of a series about how to tackle various challenges you might encounter when using Spring Data JDBC. The series consists of: 1. Spring Data JDBC - How to use custom ID generation? 2. Spring Data JDBC - How do I make bidirectional relationships?. 3. Spring Data JDBC - How ...