{"id":"EUVD-2026-62604","enisaUuid":"bd06f021-1145-3b7e-9970-f15f07c9a380","description":"Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a double quote in a query parameter name is emitted into the generated request-validation zod.object({...}) schema without safe encoding. This permits attacker-controlled JavaScript to be evaluated when the generated zod schema module is imported, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/zod/src/index.ts and query request-validation generation. This issue is fixed in version 8.21.0.","datePublished":"Aug 19, 2026, 5:36:47 PM","dateUpdated":"Aug 21, 2026, 9:49:30 PM","baseScore":9.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/orval-labs/orval/security/advisories/GHSA-653q-5476-x79g\nhttps://github.com/orval-labs/orval/pull/3692\nhttps://github.com/orval-labs/orval/commit/8ef1bfdf3f9bcaf9dabfbe2e42887f1c0e159ab6\nhttps://github.com/orval-labs/orval/releases/tag/v8.21.0\n","aliases":"CVE-2026-71865\nGHSA-653q-5476-x79g\n","assigner":"GitHub_M","epss":0.65,"enisaIdProduct":[{"id":"fd7d3c95-2e14-3ed0-a77f-59f65c9e0540","product":{"name":"orval","vendor":{"name":"orval-labs"}},"product_version":"\u003c 8.21.0"}],"enisaIdVendor":[{"id":"539da981-d620-3bb8-b652-f846bf2fb785","vendor":{"name":"orval-labs"}}],"enisaIdVulnerability":[{"id":"a44823a1-53a9-3eb6-825b-5b5e0e47b619","vulnerability":{"id":"GHSA-653q-5476-x79g","description":"Orval: Import-time RCE via query parameter name -\u003e computed-property-key injection in the zod cli","datePublished":"Sep 3, 2026, 6:18:09 PM","dateUpdated":"Sep 3, 2026, 6:18:09 PM","baseScore":0.0,"references":"https://github.com/orval-labs/orval/security/advisories/GHSA-653q-5476-x79g\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-71865\nhttps://github.com/orval-labs/orval/pull/3692\nhttps://github.com/orval-labs/orval/commit/8ef1bfdf3f9bcaf9dabfbe2e42887f1c0e159ab6\nhttps://github.com/orval-labs/orval\nhttps://github.com/orval-labs/orval/releases/tag/v8.21.0\n","enisa_id":"EUVD-2026-62604\n","aliases":"CVE-2026-71865\nGHSA-653q-5476-x79g\n","epss":0.0,"dataProcessed":"Nov 9, 2026, 3:52:25 PM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"b0ef6198-f5f6-3dd9-ba1d-66ad63108fa6","vulnerability":{"id":"CVE-2026-71865","description":"Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a double quote in a query parameter name is emitted into the generated request-validation zod.object({...}) schema without safe encoding. This permits attacker-controlled JavaScript to be evaluated when the generated zod schema module is imported, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/zod/src/index.ts and query request-validation generation. This issue is fixed in version 8.21.0.","datePublished":"Aug 19, 2026, 5:36:47 PM","dateUpdated":"Aug 21, 2026, 9:49:30 PM","status":"PUBLISHED","baseScore":9.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/orval-labs/orval/security/advisories/GHSA-653q-5476-x79g\nhttps://github.com/orval-labs/orval/pull/3692\nhttps://github.com/orval-labs/orval/commit/8ef1bfdf3f9bcaf9dabfbe2e42887f1c0e159ab6\nhttps://github.com/orval-labs/orval/releases/tag/v8.21.0\n","enisa_id":"EUVD-2026-62604\n","assigner":"GitHub_M","epss":0.65,"dataProcessed":"Nov 11, 2026, 7:19:09 AM","vulnerabilityProduct":[{"id":"f5a008cb-80a2-3ed5-9658-1accd8e0a33b","product":{"name":"orval","vendor":{"name":"orval-labs"}},"product_version":"\u003c 8.21.0"}],"vulnerabilityVendor":[{"id":"55e8d9f1-042c-3028-bb49-47a444eaea32","vendor":{"name":"orval-labs"}}]}}],"enisaIdAdvisory":[]}