Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a double quote in a query parameter name is emitted into the generated request-validation zod.object({...}) schema without safe encoding. This permits attacker-controlled JavaScript to be evaluated when the generated zod schema module is imported, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/zod/src/index.ts and query request-validation generation. This issue is fixed in version 8.21.0.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
🔴 Orval, Import-time RCE via Query Parameter Name, #CVE-2026-71865 (Critical) -DC-Sep2026-2153 https://dailycve.com/orval-import-time-rce-via-query-parameter-name-cve-2026-71865-critical-dc-sep2026-2153/
Post summary
The post introduces a critical Import‑time RCE vulnerability (CVE‑2026‑71865) in Orval, referencing a dailycve.com article but offering no PoC, exploit, or patch information.