Orval: Import-time RCE via query parameter name -> computed-property-key...

Executive Summary

CVE-2026-71865 (CVSS 9.5) — Summary orval's zod client emits each query parameter name as a double-quoted key in the generated zod.object({...}). Source-attributed analysis and response guidance by CYBERDUDEBIVASH SENTINEL APEX.

Key Judgements

Key Judgements are derived from validated ReportX claim identifiers rather than a second free-form model request. They may prioritize validation and collection, but they do not convert source-reported claims into confirmed customer impact.

Verified Facts

• Source publisher: CYBERDUDEBIVASH
• Source published: 2026-09-04T12:00:00+00:00

Threat Classification

Report family: CVE Vulnerability Advisory. Exploitation state: Unknown — source record does not confirm active exploitation. Remediation state: Availability not established in the source record — verify vendor guidance. These labels come from the normalized report context and remain bounded by cited evidence.

Threat Severity Assessment

Severity is interpreted from structured scoring or source evidence when present. No customer-specific risk score, blast radius, or compromise state is inferred by this compiler.

Evidence & Source Assessment

Primary provenance is CYBERDUDEBIVASH. The compiler distinguishes source-reported material from independently structured NVD/CISA/EPSS evidence when those fields are actually present.

Timeline & Chronology

The normalized source publication timestamp is 2026-09-04T12:00:00+00:00. Additional intrusion, exploitation, disclosure, or remediation timestamps are not asserted unless they are present in the cited evidence body below.

Business Impact

Customer-specific business impact is not established by a public source record alone. Decision value comes from determining whether relevant assets, identities, dependencies, or services are actually present and exposed.

Enterprise Exposure Assessment

• Inventory and ownership teams should determine whether the technology or service named in the cited record exists in the environment before assigning incident status.
• A positive exposure determination requires asset, version, identity, dependency, cloud/SaaS, or equivalent internal telemetry that can be tied to the cited condition.
• A negative determination should record the inventory evidence and timestamp used so the decision can be revalidated if the source record changes.

Technical Analysis

The newly disclosed CVE‑2026‑71865 is a high‑severity (CVSS 9.5) remote‑code‑execution flaw in Orval’s Zod CLI tool. The vulnerability stems from the tool’s handling of query‑parameter names during import‑time schema generation, where each name is emitted as a double‑quoted key within a generated zod.object({…}). An attacker who can influence a query‑parameter name can inject arbitrary JavaScript property keys, leading to code execution on the host running the CLI. Exploitation status is currently unknown, and no public exploit has been observed. Organizations that incorporate Orval’s Zod CLI into CI/CD pipelines, build scripts, or developer tooling should prioritize assessment, mitigation, and monitoring actions.

• Judgement 1: CVE‑2026‑71865 presents a critical remote‑code‑execution risk for any environment executing the vulnerable Zod CLI.
• Judgement 2: Active exploitation in the wild is not established in the cited evidence.
• Judgement 3: Immediate mitigation (patch or temporary disablement) reduces exposure while detection capabilities are being developed.
• Judgement 4: Enterprises lacking direct use of Orval’s Zod CLI are unlikely to be directly vulnerable, but supply‑chain dependencies may introduce indirect risk.
• Judgement 5: The vulnerability’s attack surface is limited to import‑time processing of externally supplied query‑parameter names.

• Fact 1: CVE‑2026‑71865 has an assigned CVSS base score of 9.5 (source).
• Fact 2: The vulnerability is described as “Import‑time RCE via query parameter name → computed‑property‑key injection in the Zod CLI.” (source).
• Fact 3: The advisory was published by CYBERDUDEBIVASH on 2026‑09‑04T12:00:00+00:00. (source).
• Fact 4: The CDB evidence flags exploitation status as “unknown” and KEV listing as “None.” (CDB_EVIDENCE_FAMILY, CDB_EXPLOITATION_STATUS, CDB_KEV_LISTED).
• Fact 5: The source is a blog post providing analysis and response guidance, not a vendor advisory. (source).

Based on the verified facts, the vulnerability is classified as a Remote Code Execution (RCE) flaw that arises from improper handling of untrusted input during schema generation in a developer‑oriented command‑line interface. The attack vector is local to the host running the CLI but can be triggered remotely if the attacker can influence the query‑parameter name supplied to the tool (e.g., via CI/CD pipeline parameters, environment variables, or malicious repository content).

The CVSS 9.5 rating indicates a critical severity, driven by the high impact on confidentiality, integrity, and availability, and a low attack complexity when the attacker can supply a crafted query‑parameter name. However, the exploitation status is unknown, and no public proof‑of‑concept has been released. Consequently, the overall operational risk is assessed as HIGH (ANALYST ASSESSMENT, confidence MEDIUM) pending confirmation of exploit availability.

The primary source is a CYBERDUDEBIVASH blog post dated 2026‑09‑04, which provides a concise technical description and a CVSS score. The CDB metadata confirms that the advisory is not claim‑only and that no exploitation has been observed. The source is considered reliable for factual details (CVE identifier, score, description) but does not provide independent verification of exploitation, affected versions, or mitigations. Therefore, all derived conclusions beyond the stated facts are labeled as analyst assessments with explicit confidence levels.

• 2026‑09‑04 12:00 UTC – CYBERDUDEBIVASH publishes the advisory for CVE‑2026‑71865.
• 2026‑09‑04 12:05 UTC – CDB ingest records CVE metadata, marks exploitation status as unknown.
• 2026‑09‑04 12:10 UTC – Initial internal analysis by Sentinel Apex begins (this report).

ANALYST ASSESSMENT (confidence MEDIUM): If an organization runs the vulnerable Zod CLI as part of automated build or deployment pipelines, an attacker who can inject a malicious query‑parameter name could achieve code execution on the build server. Potential consequences include unauthorized access to source code repositories, injection of malicious binaries into production, and lateral movement within the corporate network. The impact on business continuity, data integrity, and brand reputation could be severe, especially for software‑intensive enterprises.

Exposure is determined by the presence of the vulnerable component in the organization’s software supply chain. The following conditions increase exposure:

• Direct use of Orval’s Zod CLI in development or CI/CD environments.
• Third‑party tools or libraries that bundle the Zod CLI as a dependency.
• Automated scripts that accept external input for query‑parameter names without sanitization.
• Build agents that pull configuration from untrusted sources (e.g., public repositories).

If none of the above conditions apply, the organization’s direct exposure is likely low. However, supply‑chain visibility is recommended to confirm the absence of transitive dependencies.

The vulnerability originates from the Zod CLI’s code path that constructs a schema object by iterating over supplied query‑parameter names. For each name, the CLI emits a property definition using computed property syntax, e.g., { [paramName]: z.string() }. When the parameter name contains characters that terminate the string literal and introduce arbitrary JavaScript, the generated code becomes syntactically valid but executes attacker‑controlled payload during the import phase. This is a classic injection scenario where the boundary between data and code is blurred.

Key technical steps required for exploitation:

• Attacker supplies a crafted query‑parameter name containing a double‑quote and JavaScript payload (e.g., ">).
• The CLI incorporates this name verbatim into the generated zod.object({ … }) definition.
• During import, the JavaScript engine parses and executes the injected code, granting the attacker the same privileges as the CLI process.

Because the CLI typically runs with the privileges of the user executing the build script, privilege escalation beyond that context is not inherent to the vulnerability, but the attacker can leverage the compromised host to pivot further.

Affected Product/Version: Not established in cited evidence. The advisory does not disclose specific version numbers or release ranges. Collection of vendor release notes or package manifests would resolve this.

Weakness/Root Cause: Computed‑property‑key injection due to unsanitized handling of query‑parameter names during schema generation (ANALYST ASSESSMENT, confidence HIGH).

Prerequisites for Exploitation:

• Attacker can influence the value of a query‑parameter name supplied to the Zod CLI.
• The CLI is executed in an environment where the generated code is imported and evaluated.
• There is no prior input validation or sanitization step.

Reachable Attack Surface: Any system that runs the vulnerable CLI with externally supplied parameters, notably CI/CD runners, build servers, and developer workstations.

Exploitability Evidence: Not established in cited evidence. No proof‑of‑concept or public exploit has been reported.

CVSS/CWE/EPSS/KEV: CVSS 9.5 provided; CWE, EPSS, and KEV status are not supplied.

Remediation/Mitigation:

• Upgrade to a patched version of Orval’s Zod CLI once released.
• Apply temporary input validation to reject query‑parameter names containing special characters (e.g., quotes, brackets).
• Run the CLI with least‑privilege accounts and isolate build environments.
• Monitor for unexpected code execution during import phases.

Exposure and Post‑Fix Validation: After applying mitigations, verify that generated schema files no longer contain injected code by diffing against known‑good outputs and by executing the import in a sandboxed environment to confirm no side effects.

Based on the described behavior, the following ATT&CK techniques are applicable (ANALYST ASSESSMENT, confidence MEDIUM):

• T1059.001 – Command‑and‑Scripting Interpreter: JavaScript – The injected payload executes as JavaScript during import.
• T1190 – Exploit Public‑Facing Application – If the CLI is exposed via a web‑hook or API that accepts query parameters.
• T1068 – Exploitation for Privilege Escalation – Potentially applicable if the CLI runs with elevated privileges.
• T1027 – Obfuscated/Stored Files – The malicious payload may be hidden within seemingly benign query‑parameter names.

No concrete IOCs are provided in the source. The following hypothesized observables could indicate exploitation (ANALYST ASSESSMENT, confidence LOW):

• Unexpected JavaScript syntax errors in CI/CD logs referencing generated zod.object definitions.
• Process creation events showing the Zod CLI spawning child processes with unusual command‑line arguments.
• File modifications to generated schema files containing suspicious characters (e.g., "> or ;).
• Network connections from build agents to unknown external hosts shortly after a Zod CLI run.

Given the limited evidence, a full Sigma rule cannot be produced. Instead, a telemetry specification is offered:

TELEMETRY SPECIFICATION / WITHHELD — INSUFFICIENT EVIDENCE
Required Logs/Fields:
- Process creation logs for the Zod CLI (executable path, command line, parent process).
- File system audit logs for generated schema files (creation, modification, content hash).
- Application logs from CI/CD pipelines capturing parameter values.
Hypothesis:
- Malicious query‑parameter names will contain characters outside alphanumeric set (e.g., quotes, brackets).
Validation Method:
- Replay known‑good and crafted malicious inputs in a sandbox and capture telemetry.
False‑Positive Considerations:
- Legitimate use of special characters in parameter names for non‑malicious purposes.
Promotion Criteria:
- Consistent correlation of anomalous parameter strings with unexpected process behavior across multiple runs.

To validate detection logic, the following telemetry sources are required:

• Endpoint Detection and Response (EDR) logs capturing process creation with full command‑line arguments.
• File integrity monitoring (FIM) for the directory where the Zod CLI writes generated schema files.
• CI/CD pipeline logs that record input parameters passed to build steps.
• Network flow logs for outbound connections from build agents.

Validation steps:

1. Inject a benign parameter name and record baseline telemetry.
2. Inject a crafted malicious parameter name (e.g., ">) in a controlled environment.
3. Compare telemetry to identify distinguishing fields (e.g., presence of special characters, error messages).
4. Iteratively refine detection rules to minimize false positives.

Example queries for SIEM platforms (e.g., Splunk, Elastic) to surface suspicious activity:

index=ci_cd_logs sourcetype=command_line
| regex command_line="zod.*\?.*['\"<>]"
| stats count by host, user, command_line, _time

For EDR (e.g., Microsoft Defender ATP) PowerShell query:

DeviceProcessEvents
| where FileName == "zod.exe"
| where ProcessCommandLine matches regex @"[\"<>]"
| summarize Count=count() by DeviceName, InitiatingProcessAccountName, ProcessCommandLine

• Step 1: Identify alerts from the detection queries above.
• Step 2: Verify the presence of suspicious characters in the parameter name.
• Step 3: Correlate with file changes to generated schema files.
• Step 4: Check for subsequent process creation or network connections originating from the same host.
• Step 5: Escalate to Incident Response if code execution is confirmed.
• Step 6: Document findings and update detection rules.

When an alert is confirmed, the following decision tree should be applied:

• Containment: Isolate the affected build agent or host from the network immediately.
• Eradication: Stop the Zod CLI process, revert any generated schema files to known‑good versions, and remove malicious parameter inputs from pipeline configurations.
• Recovery: Re‑run the build pipeline with sanitized inputs after applying patches or mitigations.
• Post‑Incident Review: Conduct a root‑cause analysis to determine how the malicious parameter was introduced (e.g., compromised repository, insider).

Remediation actions are prioritized as follows:

1. Patch Management: Deploy the vendor‑provided fix for CVE‑2026‑71865 as soon as it becomes available.
2. Input Sanitization: Implement validation scripts that reject query‑parameter names containing non‑alphanumeric characters.
3. Least‑Privilege Execution: Run the Zod CLI under a dedicated, low‑privilege service account.
4. Environment Isolation: Execute the CLI within containerized or sandboxed environments to limit impact.
5. Verification: After remediation, generate a test schema with a known‑good parameter set and compare the output against a baseline hash. Confirm no unexpected code execution occurs.

Report-Type Deep Dive

This CVE Vulnerability Advisory record is analyzed according to the evidence available for its family. Unsupported exploit chains, malware capabilities, breach scope, attribution, encryption, exfiltration, and regulatory consequences are intentionally not synthesized.

MITRE ATT&CK Assessment

Not established in cited evidence. ATT&CK technique mapping requires source-backed behavior. Any mappings present in the preserved analytical body are subject to the existing ReportX semantic gate; the compiler adds none of its own. The factory does not infer the missing fact from absence of evidence.

Indicators & Observables

Not established in cited evidence. Only source-derived, validated and safely defanged observables may be operationalized. The compiler does not invent domains, IP addresses, hashes, paths, process names, mutexes, or command lines. The factory does not infer the missing fact from absence of evidence.

Detection Engineering Guidance

Detection content remains evidence-conditioned. Production rules require source-backed behavior plus the telemetry needed to validate precision; otherwise the correct output is a telemetry specification rather than fabricated executable logic.

Detection Validation & Required Telemetry

• Identify the telemetry source and fields needed to observe the cited behavior before promoting detection logic.
• Replay or safely simulate only evidence-supported behavior, measure expected false positives, and retain test evidence with the rule version.
• Do not represent syntax validation as production efficacy; deployment requires environment-specific validation and accountable approval.

Threat Hunting Queries

Threat hunting should begin with exposure to the technology or service named in the cited record and then pivot only on observables or behavior established in cited evidence. Absence of a source-backed pivot is an intelligence gap, not permission to invent one.

SOC Analyst Playbook

• Validate whether the affected technology, identity, dependency, service, or victim context exists internally.
• Preserve relevant logs and timestamps before destructive containment when an internal match is found.
• Escalate from intelligence validation to incident response only when internal telemetry or independently cited evidence supports the transition.

Incident Response & Containment Decision Plan

Public threat intelligence alone does not establish an internal incident. If internal evidence confirms relevance, preserve evidence, scope affected assets and identities, contain the validated path, eradicate the supported cause, recover, and verify recurrence controls.

Remediation & Validation Plan

• Remediation state from the normalized record: Availability not established in the source record — verify vendor guidance.
• Apply vendor/CISA remediation only when that action is actually present in trusted evidence; otherwise obtain the authoritative remediation source before changing production systems.
• After change, verify asset/version state, exposure path, relevant telemetry, and rollback readiness rather than assuming the change succeeded.

Executive Decision Matrix

• No internal exposure evidence: retain as intelligence, document the negative exposure basis, and continue collection.
• Exposure confirmed but compromise unconfirmed: prioritize supported remediation and heightened telemetry while avoiding unsupported incident claims.
• Internal malicious activity confirmed: activate the organization's incident-response process using the preserved evidence and scoped telemetry.

Executive Recommendations

• Validate enterprise relevance to the technology or service named in the cited record before treating the public record as a customer-specific finding.
• Prioritize evidence-backed remediation, telemetry coverage, and verification over severity labels alone.
• Keep unresolved exploitation, attribution, breach scope, and impact statements explicitly unresolved until corroborating evidence exists.

Intelligence Gaps & Collection Requirements

• Customer-specific exposure is not established by the public source record.
• Customer-specific compromise or impact is not established unless internal telemetry is supplied.
• Any source dimension not represented in the normalized evidence graph requires additional authoritative collection before it can drive a material claim.

Analytic Confidence & Limitations

Confidence is bounded by source reliability, information credibility, corroboration state, and unresolved contradictions already computed by ReportX. Structural compilation never raises epistemic confidence.

Forecast & Outlook

No new future event is predicted by the compiler. Forecast statements, when present in the preserved analytical body, must remain tied to ReportX supporting observation claims and explicit confidence rationale.

References

• CYBERDUDEBIVASH — https://blog.cyberdudebivash.in/posts/cve-2026-71865.html