Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a double quote in a header parameter name is emitted into the generated request-validation zod.object({...}) schema without safe encoding. This permits attacker-controlled JavaScript to be evaluated when the generated zod schema module is imported, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/zod/src/index.ts and header request-validation generation. This issue is fixed in version 8.21.0.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
🔴 Orval, Code Injection (#CVE-2026-71864) (CRITICAL) -DC-Sep2026-2158 https://dailycve.com/orval-code-injection-cve-2026-71864-critical-dc-sep2026-2158/
Post summary
A brief notice announces a critical code injection vulnerability (CVE-2026-71864) in Orval, providing no further details on exploitation status, patches, or technical specifics.