Security readout for executives and security teams
Plain-English summary
A malicious OpenAPI or Swagger specification can cause vulnerable Orval versions to generate unsafe JavaScript. When the generated Zod schema is imported, attacker-controlled code may run in developer machines, CI pipelines, tests, or applications, potentially exposing credentials or altering builds.
Executive priority
Treat as an urgent software-supply-chain remediation where vulnerable Orval processes untrusted specifications. Prioritize CI systems and developer environments holding signing keys, deployment credentials, cloud tokens, or production access. Lower priority may be justified only after confirming Orval is unaffected, Zod generation is unused, or all specification inputs are trusted.
Technical view
Before Orval 8.21.0, formatDefaultValue in packages/zod/src/index.ts failed to safely encode enum defaults containing template-literal syntax. Zod generation placed this data inside a module-level template literal, enabling JavaScript evaluation when the generated module was imported. The issue is classified as CWE-1336 and CWE-94, with CVSS 4.0 score 9.3.
Likely exposure
Exposure requires Orval below 8.21.0, Zod schema generation, attacker-influenced API specifications, and subsequent import of generated output. Highest-risk environments automatically ingest remote, third-party, or contributor-controlled specifications during CI or builds. Ordinary runtime deployments may also be affected if vulnerable generated modules were incorporated.
Exploitation context
The supplied sources do not establish active exploitation, and the CVE is not identified as KEV. Exploitation depends on controlling an enum default in an input specification and having generated Zod code imported. This is a software-supply-chain and build-pipeline risk, not necessarily direct exposure of a public web endpoint.
Researcher notes
The trust boundary is the specification-to-generated-code transition. Successful impact occurs at module import rather than only during generation, so both generation infrastructure and consumers of generated artifacts require review. The supplied evidence identifies the vulnerable function and fixed release, but provides no evidence about exploitation prevalence or affected downstream packages.
Mitigation direction
- Upgrade Orval to version 8.21.0 or later.
- Regenerate Zod schemas from trusted specifications after upgrading.
- Rebuild and redeploy artifacts containing previously generated schemas.
- Restrict specification ingestion to authenticated, reviewed, and trusted sources.
- Investigate affected environments and rotate exposed credentials if unauthorized execution is suspected.
Validation and detection
- Check package manifests and lockfiles for Orval versions below 8.21.0.
- Determine whether projects use Orval's Zod schema generation.
- Identify remote, third-party, or contributor-controlled specifications processed by builds.
- Review generated schemas for unusual enum defaults or unexpected module-level code.
- Inspect CI, developer, test, and application telemetry for anomalous activity during schema imports.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-1336: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-94: Code execution behavior lookup
Code execution and unsafe deserialization weaknesses often justify reviewing execution behavior and process telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-71868 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.3 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N——GitHub_MVulnerability scoring details
Base CVSS 4.0 score
9.3CriticalVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/orval-labs/orval/security/advisories/GHSA-3575-w9fc-c2j6CVE reference, GitHub_M · x_refsource_CONFIRM
- https://github.com/orval-labs/orval/pull/3692CVE reference, GitHub_M · x_refsource_MISC
- https://github.com/orval-labs/orval/commit/8ef1bfdf3f9bcaf9dabfbe2e42887f1c0e159ab6CVE reference, GitHub_M · x_refsource_MISC
- https://github.com/orval-labs/orval/releases/tag/v8.21.0CVE reference, GitHub_M · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Special Elements Used in a Template Engine
Improper Neutralization of Special Elements Used in a Template Engine represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Improper Control of Generation of Code
Improper Control of Generation of Code represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.