Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a ${...} expression or backtick in a schema default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permits attacker-controlled JavaScript to be evaluated when the generated zod schema module is imported, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/zod/src/index.ts function formatDefaultValue. This issue is fixed in version 8.21.0.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
🔴 Orval, Import-Time Remote Code Execution via Template Literal Injection, #CVE-2026-72717 (CRITICAL) -DC-Sep2026-2157 https://dailycve.com/orval-import-time-remote-code-execution-via-template-literal-injection-cve-2026-72717-critical-dc-sep2026-2157/
Post summary
The post announces a new critical RCE vulnerability in Orval (CVE‑2026‑72717) with a link to the DailyCVE article but contains no PoC, exploit code, or patch information.