CVE-2026-71866criticalCWE-89CWE-95

CVE-2026-71866: falha crítica em orval-labs orval

Orval: Import-time RCE via schema property name -> computed-property-key injection in the zod client

Publicada em

Seguir esta CVE+ Monitorar orval+ Monitorar orval

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.3epss 0.7%
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. From version 8.19.0 until 8.21.0, a double quote in a schema property name is emitted into the generated zod.object({...}) schema without safe encoding. This permits attacker-controlled JavaScript to be evaluated when the generated zod schema module is imported, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/zod/src/index.ts and zod object-key generation. This issue is fixed in version 8.21.0.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
orval-labs · orval
CVEs relacionadas — orval-labs orval

No mesmo produto, das mais perigosas para as menos.

CVE-2026-96756CRITICALorval before 8.30.0 Code Injection via Factory GenerationEPSS 0.9%CVE-2026-23947CRITICALOrval MCP client is vulnerable to code injection via unsanitized x-enum-descriptions in enum generationEPSS 0.8%CVE-2026-96757CRITICALorval before 8.29.0 Code Injection via unescaped OpenAPI media-typeEPSS 0.8%CVE-2026-96758CRITICALorval @orval/core before 8.28.0 Code Injection via Form-DataEPSS 0.8%CVE-2026-96755CRITICALorval @orval/effect 8.14.0 through 8.28.1 Code InjectionEPSS 0.8%CVE-2026-22785CRITICALorval MCP client is vulnerable to a code injection attack.EPSS 0.8%