Critical Orval vulnerability allows remote code execution

A critical vulnerability has been identified in the Orval library, allowing for remote code execution (RCE) through improperly handled query parameter names. This issue, tracked as CVE-2026-71865, affects version 8.19.0 and is linked to the zod client, which fails to escape double quotes in generated request-validation schemas. As a result, an attacker can exploit this flaw during the import phase of the module, leading to potential security breaches in applications utilizing Orval for API integrations.

Developers using OpenClaw should be aware of this vulnerability as it highlights the importance of secure coding practices, especially when dealing with user input in agent workflows. The incident underscores the need for regular model updates and thorough testing of developer tooling to mitigate risks associated with such vulnerabilities. As the community responds to this issue, it will be crucial to monitor release notes for patches and updates that address these security concerns.