{"vulnerability": "cve-2026-71869", "sightings": [{"uuid": "7f7bc007-41b6-4096-af35-4d6c46b065a7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71869", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mthk2b3kuc2u", "content": "\ud83d\udea8 CVE-2026-71869 \u2014 CVSS 9.3 CRITICAL\n\nOrval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. P...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-71869\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-08-19T20:10:59.673589Z"}, {"uuid": "1c8c9751-08e4-4fd1-ba69-19c4d440fc6d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71869", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mthxxotjuz2u", "content": "CVE-2026-71869 - orval\nOrval, a tool used to generate TypeScript clients from API specs, had a security flaw that allowed attackers to inject malicious code. This could lead to code execution on a\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#orval #orvallabs #CVE #infosec", "creation_timestamp": "2026-08-20T00:20:05.739325Z"}, {"uuid": "be05835a-1902-41d6-9312-859c9d21c306", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71869", "type": "seen", "source": "https://gist.github.com/alon710/ca4d0cdb0c789284d2fa209ad1644bb6", "content": "# CVE-2026-71869: CVE-2026-71869: Remote Code Execution in Orval via OpenAPI Default Value Template Literal Injection\n\n> **CVSS Score:** 9.3\n> **Published:** 2026-09-03\n> **Full Report:** https://cvereports.com/reports/CVE-2026-71869\n\n## Summary\nCVE-2026-71869 is a critical-severity code injection vulnerability in the Orval code generator (packages: orval, @orval/core, @orval/zod) prior to version 8.21.0. This flaw allows remote attackers to execute arbitrary JavaScript code at import-time by embedding malicious payloads into the default values of OpenAPI or Swagger specifications. This report details the root cause, exploitation mechanism, and patch remediation.\n\n## TL;DR\nA critical vulnerability in Orval allows remote code execution at import-time via unescaped string default values in OpenAPI specifications during Zod schema generation.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-94, CWE-116, CWE-1336\n- **Attack Vector**: Network\n- **CVSS Score**: 9.3 (Critical)\n- **EPSS Score**: 0.00478\n- **Impact**: Remote Code Execution (RCE) at Import-Time\n- **Exploit Status**: Proof of Concept (PoC) documented\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Orval code generator (packages: orval, @orval/core, @orval/zod) versions < 8.21.0\n- **orval**: < 8.21.0 (Fixed in: `8.21.0`)\n- **@orval/core**: < 8.21.0 (Fixed in: `8.21.0`)\n- **@orval/zod**: < 8.21.0 (Fixed in: `8.21.0`)\n\n## Mitigation\n\n- Upgrade all Orval packages to version 8.21.0 or higher.\n- Isolate and sandbox code generation environments.\n- Pre-audit and lint untrusted third-party OpenAPI specs.\n\n**Remediation Steps:**\n1. Identify all projects containing orval, @orval/core, or @orval/zod in package.json.\n2. Run 'npm install orval@8.21.0 --save-dev' or the equivalent for yarn/pnpm.\n3. If running via Docker, update CLI references to ghcr.io/orval-labs/orval:8.21.0.\n4. Regenerate client assets and verify that output files contain properly escaped backticks and string variables.\n\n## References\n\n- [GitHub Security Advisory GHSA-2h9g-j24r-h63g](https://github.com/orval-labs/orval/security/advisories/GHSA-2h9g-j24r-h63g)\n- [GitHub Fix Commit](https://github.com/orval-labs/orval/commit/8ef1bfdf3f9bcaf9dabfbe2e42887f1c0e159ab6)\n- [GitHub Pull Request](https://github.com/orval-labs/orval/pull/3692)\n- [Orval Release v8.21.0](https://github.com/orval-labs/orval/releases/tag/v8.21.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-71869) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-03T19:32:48.385420Z"}, {"uuid": "b2fbfd79-8548-4dd5-97fd-6247d8076924", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-71869", "type": "published-proof-of-concept", "source": "https://github.com/orval-labs/orval/security/advisories/GHSA-2h9g-j24r-h63g", "content": "", "creation_timestamp": "2026-09-03T20:35:22.433861Z"}]}