CVE-2026-72717

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a ${...} expression or backtick in a schema default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permits attacker-controlled JavaScript to be evaluated when the generated zod schema module is imported, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/zod/src/index.ts function formatDefaultValue. This issue is fixed in version 8.21.0.

• CWE-94
• CWE-116
• CWE-1336

• https://github.com/orval-labs/orval/commit/8ef1bfdf3f9bcaf9dabfbe2e42887f1c0e159ab6
• https://github.com/orval-labs/orval/pull/3692
• https://github.com/orval-labs/orval/releases/tag/v8.21.0
• https://github.com/orval-labs/orval/security/advisories/GHSA-w727-8j6c-2rj4
• https://github.com/orval-labs/orval/security/advisories/GHSA-w727-8j6c-2rj4

Published

Aug 19, 2026

Last Modified

Sep 9, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-72710SPIP before 4.4.18 contains a mass assignment vulnerability …9.8
• CVE-2026-72711The Lean 4 kernel does not check that the body of an opaque …6.3
• CVE-2026-72712Nmap versions up to and including 7.99 contains a denial of …6.5
• CVE-2026-72713XAgent contains a path traversal vulnerability in the worksp…7.5
• CVE-2026-72714Rocq Prover does not restore the universe graph's copy of th…6.3
• CVE-2026-72716Orval generates type-safe JavaScript clients in TypeScript f…9.3
• CVE-2026-72718goose is general-purpose AI agent that runs on your machine.…7
• CVE-2026-72719Chatwoot is a customer engagement suite. Prior to 4.9.0, Cha…6.7
• CVE-2026-7272A flaw has been found in WilliamCloudQi matlab-mcp-server up…7.3
• CVE-2026-72720Discourse is an open-source discussion platform. Prior to 20…6.4
• CVE-2026-72721Discourse is an open-source discussion platform. Prior to 20…5.3
• CVE-2026-72722Discourse is an open-source discussion platform. Prior to 20…4.3