THREATOPS
THREAT OPS › Threat News › [GHSA] GHSA-8j6p-r8jg-mxqh (critical) — Orval: Import-time RCE via header-parameter default -> zod module-level template literal

[GHSA] GHSA-8j6p-r8jg-mxqh (critical) — Orval: Import-time RCE via header-parameter default -> zod module-level template literal

medgithub_advisoriesPublished 2026-09-03

GHSA-8j6p-r8jg-mxqh Severity: critical CVE: CVE-2026-71871

Orval: Import-time RCE via header-parameter default -> zod module-level template literal

### Summary

Orval's zod schema generation emits the **header-parameter** `default` value as a module-level template literal (`export const Default = `<default>`;`) without escaping `${` or the backtick. A default of the form `v${<code>}w` injects a

MITRE ATT&CK techniques

Indicators of compromise

Original source: https://github.com/advisories/GHSA-8j6p-r8jg-mxqh