THREATOPS
THREAT OPS › Threat News › [GHSA] GHSA-6mr6-jvcr-2f25 (critical) — Orval: Import-time RCE via schema property name -> computed-property-key injection in the zod client

[GHSA] GHSA-6mr6-jvcr-2f25 (critical) — Orval: Import-time RCE via schema property name -> computed-property-key injection in the zod client

medgithub_advisoriesPublished 2026-09-02

GHSA-6mr6-jvcr-2f25 Severity: critical CVE: CVE-2026-71866

Orval: Import-time RCE via schema property name -> computed-property-key injection in the zod client

### Summary

orval's zod client emits each schema property name as a double-quoted key in the generated zod.object({...}) WITHOUT escaping the double quote. A " in a property name closes the key and lands in object-literal context, where

MITRE ATT&CK techniques

Indicators of compromise

Original source: https://github.com/advisories/GHSA-6mr6-jvcr-2f25