CVE-2026-72716

The record

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a ${...} expression or backtick in a query parameter default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permits attacker-controlled JavaScript to be evaluated when the generated zod schema module is imported, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/zod/src/index.ts function formatDefaultValue. This issue is fixed in version 8.21.0.

Affected packages

Related vulnerabilities

• CVE-2026-96392 Improper Neutralization of Special Elements Used in a Template Engine vulnerability in… CWE-1336
• CVE-2026-96355 Improper Neutralization of Special Elements Used in a Template Engine vulnerability in… CWE-1336
• CVE-2026-104851 fsspec is a specification and Python implementation framework for filesystem interfaces. CWE-1336
• CVE-2026-9160 Improper neutralization of special elements used in a template engine vulnerability in… CWE-1336
• CVE-2026-19584 Velociraptor allows for the creation of notebook backups in its default enabled daily… CWE-1336
• CVE-2026-75650 Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a… CWE-1336
• CVE-2026-52762 YesWiki is a wiki system written in PHP. CWE-1336
• CVE-2026-85654 Improper neutralization of special elements used in a template engine in the CDK… CWE-1336