An attacker who can provide or influence an OpenAPI specification can include a crafted default value containing a JavaScript expression, such as v${<attacker-controlled-JS>}w. When an application imports the generated Zod schema module, the JavaScript engine evaluates the interpolated expression, leading to arbitrary code execution within the context of the importing process. This vulnerability is present in Orval version 8.19.0 and affects all versions prior to 8.21.0. The exploit requires no additional API interaction once the malicious schema is generated and integrated into the victim's codebase.

Impact

Successful exploitation results in arbitrary code execution during the build or runtime import phase of any application relying on Orval-generated schemas. This poses a significant risk to CI/CD pipelines, build servers, and runtime environments that process untrusted OpenAPI descriptions. The scope includes any application that integrates Orval to generate schemas from attacker-influenced input sources, such as public repositories or user-submitted API documentation.

Recommendation

Prioritized, concrete actions for development and security teams:

• Upgrade Orval to version 8.21.0 or later immediately to resolve CVE-2026-72716.
• Audit existing OpenAPI specifications used in build processes to ensure default values do not contain suspicious syntax like ${ or backticks.
• If immediate patching is not possible, implement strict validation of OpenAPI specification files before feeding them into the Orval generator.
• Review build pipeline logs for unexpected execution of JavaScript modules generated by Orval.