Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
44 vulnerabilities by orval-labs
CVE-2026-96759 (GCVE-0-2026-96759)
Vulnerability from nvd – Published: 2026-09-23 16:23 – Updated: 2026-09-29 02:01
VLAI
EPSS
VEX
Title
orval before 8.29.0 Code Injection via operationId
Summary
orval before 8.29.0 fails to escape the operationId parameter when emitting it into generated TanStack Query mutator options metadata objects. Attackers can inject arbitrary JavaScript code through a crafted operationId in an OpenAPI specification that executes when generated hooks are called.
Severity
9.8 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-29 02:00 UTC
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/orval-labs/orval/security/advi… | vendor-advisory |
| https://github.com/orval-labs/orval/pull/4008 | patchissue-tracking |
| https://github.com/orval-labs/orval/commit/b28c53… | patch |
| https://github.com/orval-labs/orval/blob/v8.28.1/… | technical-description |
| https://github.com/orval-labs/orval | product |
| https://www.vulncheck.com/advisories/orval-before… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| orval-labs | orval |
Affected:
0 , < 8.29.0
(semver)
Unaffected: 8.29.0 (semver) cpe:2.3:a:orval:orval:*:*:*:*:*:*:*:* |
Date Public
2026-09-06 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-96759",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-29T02:00:51.406766Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T02:01:12.244Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/orval-labs/orval/security/advisories/GHSA-vv88-cm6j-665j"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/orval",
"product": "orval",
"vendor": "orval-labs",
"versions": [
{
"lessThan": "8.29.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "8.29.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:orval:orval:*:*:*:*:*:*:*:*",
"versionEndExcluding": "8.29.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Enrik Mustafa"
}
],
"datePublic": "2026-09-06T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "orval before 8.29.0 fails to escape the operationId parameter when emitting it into generated TanStack Query mutator options metadata objects. Attackers can inject arbitrary JavaScript code through a crafted operationId in an OpenAPI specification that executes when generated hooks are called."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T16:23:58.251Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-vv88-cm6j-665j)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/orval-labs/orval/security/advisories/GHSA-vv88-cm6j-665j"
},
{
"tags": [
"patch",
"issue-tracking"
],
"url": "https://github.com/orval-labs/orval/pull/4008"
},
{
"tags": [
"patch"
],
"url": "https://github.com/orval-labs/orval/commit/b28c53f3e0c06190e0f6ea136737e6316432448f"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/orval-labs/orval/blob/v8.28.1/packages/query/src/query-generator.ts#L784"
},
{
"tags": [
"product"
],
"url": "https://github.com/orval-labs/orval"
},
{
"name": "VulnCheck Advisory: orval before 8.29.0 Code Injection via operationId",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/orval-before-8.29.0-code-injection-via-operationid"
}
],
"title": "orval before 8.29.0 Code Injection via operationId",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-96759",
"datePublished": "2026-09-23T16:23:58.251Z",
"dateReserved": "2026-09-23T15:58:31.829Z",
"dateUpdated": "2026-09-29T02:01:12.244Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-96758 (GCVE-0-2026-96758)
Vulnerability from nvd – Published: 2026-09-23 16:23 – Updated: 2026-09-23 18:39
VLAI
EPSS
VEX
Title
orval @orval/core before 8.28.0 Code Injection via Form-Data
Summary
orval @orval/core before 8.28.0 contains a code injection vulnerability in the form-data serializer that fails to escape multipart property names in generated template literals. Attackers can inject ${...} expressions into OpenAPI schema property names that execute as live interpolation when the generated client builds FormData bodies with consumer process privileges.
Severity
9.8 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-23 18:38 UTC
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/orval-labs/orval/security/advi… | vendor-advisory |
| https://github.com/orval-labs/orval/pull/3988 | patchissue-tracking |
| https://github.com/orval-labs/orval/commit/975a76… | patch |
| https://github.com/orval-labs/orval/blob/v8.27.0/… | technical-description |
| https://github.com/orval-labs/orval | product |
| https://www.vulncheck.com/advisories/orval-orval-… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| orval-labs | orval |
Affected:
0 , < 8.28.0
(semver)
Unaffected: 8.28.0 (semver) cpe:2.3:a:orval:orval:*:*:*:*:*:*:*:* |
Date Public
2026-09-06 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-96758",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-23T18:38:59.966755Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T18:39:05.559Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/orval-labs/orval/security/advisories/GHSA-jwhm-6748-j6pq"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/orval",
"product": "orval",
"vendor": "orval-labs",
"versions": [
{
"lessThan": "8.28.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "8.28.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:orval:orval:*:*:*:*:*:*:*:*",
"versionEndExcluding": "8.28.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Enrik Mustafa"
}
],
"datePublic": "2026-09-06T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "orval @orval/core before 8.28.0 contains a code injection vulnerability in the form-data serializer that fails to escape multipart property names in generated template literals. Attackers can inject ${...} expressions into OpenAPI schema property names that execute as live interpolation when the generated client builds FormData bodies with consumer process privileges."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T16:23:56.849Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-jwhm-6748-j6pq)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/orval-labs/orval/security/advisories/GHSA-jwhm-6748-j6pq"
},
{
"tags": [
"patch",
"issue-tracking"
],
"url": "https://github.com/orval-labs/orval/pull/3988"
},
{
"tags": [
"patch"
],
"url": "https://github.com/orval-labs/orval/commit/975a769a76151354dead879feadfa3537ff065fe"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/orval-labs/orval/blob/v8.27.0/packages/core/src/getters/res-req-types.ts#L808"
},
{
"tags": [
"product"
],
"url": "https://github.com/orval-labs/orval"
},
{
"name": "VulnCheck Advisory: orval @orval/core before 8.28.0 Code Injection via Form-Data",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/orval-orval-core-before-8.28.0-code-injection-via-form-data"
}
],
"title": "orval @orval/core before 8.28.0 Code Injection via Form-Data",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-96758",
"datePublished": "2026-09-23T16:23:56.849Z",
"dateReserved": "2026-09-23T15:58:31.321Z",
"dateUpdated": "2026-09-23T18:39:05.559Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-96757 (GCVE-0-2026-96757)
Vulnerability from nvd – Published: 2026-09-23 16:23 – Updated: 2026-09-23 17:48
VLAI
EPSS
VEX
Title
orval before 8.29.0 Code Injection via unescaped OpenAPI media-type
Summary
orval before 8.29.0 fails to escape OpenAPI media-type keys when emitting them into single-quoted Content-Type string literals in generated code. Attackers can inject JavaScript through crafted media-type keys in OpenAPI specifications that executes when generated fetch operations or mock resolvers are invoked.
Severity
9.8 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-23 17:47 UTC
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://github.com/orval-labs/orval/security/advi… | vendor-advisory |
| https://github.com/orval-labs/orval/security/advi… | vendor-advisory |
| https://github.com/orval-labs/orval/pull/4007 | patchissue-tracking |
| https://github.com/orval-labs/orval/commit/43af28… | patch |
| https://github.com/orval-labs/orval/commit/a2d4af… | patch |
| https://github.com/orval-labs/orval/blob/v8.28.1/… | technical-description |
| https://github.com/orval-labs/orval | product |
| https://www.vulncheck.com/advisories/orval-before… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| orval-labs | orval |
Affected:
6.7.1 , < 8.29.0
(semver)
Unaffected: 8.29.0 (semver) cpe:2.3:a:orval:orval:*:*:*:*:*:*:*:* |
Date Public
2026-09-06 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-96757",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-23T17:47:51.520475Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T17:48:29.041Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/orval-labs/orval/security/advisories/GHSA-4q3x-rqfw-3x8p"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/orval",
"product": "orval",
"vendor": "orval-labs",
"versions": [
{
"lessThan": "8.29.0",
"status": "affected",
"version": "6.7.1",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "8.29.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:orval:orval:*:*:*:*:*:*:*:*",
"versionEndExcluding": "8.29.0",
"versionStartIncluding": "6.7.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Enrik Mustafa"
}
],
"datePublic": "2026-09-06T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "orval before 8.29.0 fails to escape OpenAPI media-type keys when emitting them into single-quoted Content-Type string literals in generated code. Attackers can inject JavaScript through crafted media-type keys in OpenAPI specifications that executes when generated fetch operations or mock resolvers are invoked."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T16:23:55.164Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-4q3x-rqfw-3x8p)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/orval-labs/orval/security/advisories/GHSA-4q3x-rqfw-3x8p"
},
{
"name": "GitHub Security Advisory (GHSA-rcpr-mq4m-jx9j)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/orval-labs/orval/security/advisories/GHSA-rcpr-mq4m-jx9j"
},
{
"tags": [
"patch",
"issue-tracking"
],
"url": "https://github.com/orval-labs/orval/pull/4007"
},
{
"tags": [
"patch"
],
"url": "https://github.com/orval-labs/orval/commit/43af282d62dca0ef3140023741fb768f6a718adb"
},
{
"tags": [
"patch"
],
"url": "https://github.com/orval-labs/orval/commit/a2d4af59f3b167dc8a7a65d15f51cdb89ebe2fe5"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/orval-labs/orval/blob/v8.28.1/packages/fetch/src/index.ts#L584"
},
{
"tags": [
"product"
],
"url": "https://github.com/orval-labs/orval"
},
{
"name": "VulnCheck Advisory: orval before 8.29.0 Code Injection via unescaped OpenAPI media-type",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/orval-before-8.29.0-code-injection-via-unescaped-openapi-media-type"
}
],
"title": "orval before 8.29.0 Code Injection via unescaped OpenAPI media-type",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-96757",
"datePublished": "2026-09-23T16:23:55.164Z",
"dateReserved": "2026-09-23T15:58:30.841Z",
"dateUpdated": "2026-09-23T17:48:29.041Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-96756 (GCVE-0-2026-96756)
Vulnerability from nvd – Published: 2026-09-23 16:23 – Updated: 2026-09-23 19:44
VLAI
EPSS
VEX
Title
orval before 8.30.0 Code Injection via Factory Generation
Summary
orval versions before 8.30.0 contain a code injection vulnerability in the @orval/core factory generator that fails to escape date default values in new Date() calls. Attackers can inject arbitrary expressions through apostrophes in OpenAPI schema defaults to execute code with the privileges of the consumer process when factoryMethods and useDates options are enabled.
Severity
8.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-23 18:11 UTC
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/orval-labs/orval/security/advi… | vendor-advisory |
| https://github.com/orval-labs/orval/pull/4038 | patchissue-tracking |
| https://github.com/orval-labs/orval/commit/b9b083… | patch |
| https://github.com/orval-labs/orval/blob/v8.29.0/… | technical-description |
| https://github.com/orval-labs/orval | product |
| https://www.vulncheck.com/advisories/orval-before… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| orval-labs | orval |
Affected:
0 , < 8.30.0
(semver)
Unaffected: 8.30.0 (semver) cpe:2.3:a:orval:orval:*:*:*:*:*:*:*:* |
Date Public
2026-09-07 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-96756",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-23T18:11:23.190187Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T19:44:36.697Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/orval",
"product": "orval",
"vendor": "orval-labs",
"versions": [
{
"lessThan": "8.30.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "8.30.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:orval:orval:*:*:*:*:*:*:*:*",
"versionEndExcluding": "8.30.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Enrik Mustafa"
}
],
"datePublic": "2026-09-07T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "orval versions before 8.30.0 contain a code injection vulnerability in the @orval/core factory generator that fails to escape date default values in new Date() calls. Attackers can inject arbitrary expressions through apostrophes in OpenAPI schema defaults to execute code with the privileges of the consumer process when factoryMethods and useDates options are enabled."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 9.2,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T16:23:53.491Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-wx66-36r6-v5g7)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/orval-labs/orval/security/advisories/GHSA-wx66-36r6-v5g7"
},
{
"tags": [
"patch",
"issue-tracking"
],
"url": "https://github.com/orval-labs/orval/pull/4038"
},
{
"tags": [
"patch"
],
"url": "https://github.com/orval-labs/orval/commit/b9b083576943c683540200eb957feced57dddc1a"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/orval-labs/orval/blob/v8.29.0/packages/core/src/generators/factory.ts#L493"
},
{
"tags": [
"product"
],
"url": "https://github.com/orval-labs/orval"
},
{
"name": "VulnCheck Advisory: orval before 8.30.0 Code Injection via Factory Generation",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/orval-before-8.30.0-code-injection-via-factory-generation"
}
],
"title": "orval before 8.30.0 Code Injection via Factory Generation",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-96756",
"datePublished": "2026-09-23T16:23:53.491Z",
"dateReserved": "2026-09-23T15:58:25.631Z",
"dateUpdated": "2026-09-23T19:44:36.697Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-96755 (GCVE-0-2026-96755)
Vulnerability from nvd – Published: 2026-09-23 16:23 – Updated: 2026-09-23 16:47
VLAI
EPSS
VEX
Title
orval @orval/effect 8.14.0 through 8.28.1 Code Injection
Summary
orval versions 8.14.0 through 8.28.1 contain a code injection vulnerability in the @orval/effect generator that converts OpenAPI schema defaults into template literals. Attackers can inject arbitrary JavaScript expressions via schema defaults containing ${...} syntax, which are executed at module scope when the generated code is built or imported.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-23 16:47 UTC
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/orval-labs/orval/security/advi… | vendor-advisory |
| https://github.com/orval-labs/orval/pull/3995 | patchissue-tracking |
| https://github.com/orval-labs/orval/commit/d346d9… | patch |
| https://github.com/orval-labs/orval/blob/v8.28.1/… | technical-description |
| https://github.com/orval-labs/orval | product |
| https://www.vulncheck.com/advisories/orval-orval-… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| orval-labs | orval |
Affected:
8.14.0 , < 8.29.0
(semver)
Unaffected: 8.29.0 (semver) cpe:2.3:a:orval:orval:*:*:*:*:*:*:*:* |
Date Public
2026-09-06 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-96755",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-23T16:47:05.260070Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T16:47:31.442Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/orval-labs/orval/security/advisories/GHSA-q7f2-jg6j-r867"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/orval",
"product": "orval",
"vendor": "orval-labs",
"versions": [
{
"lessThan": "8.29.0",
"status": "affected",
"version": "8.14.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "8.29.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:orval:orval:*:*:*:*:*:*:*:*",
"versionEndExcluding": "8.29.0",
"versionStartIncluding": "8.14.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Enrik Mustafa"
}
],
"datePublic": "2026-09-06T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "orval versions 8.14.0 through 8.28.1 contain a code injection vulnerability in the @orval/effect generator that converts OpenAPI schema defaults into template literals. Attackers can inject arbitrary JavaScript expressions via schema defaults containing ${...} syntax, which are executed at module scope when the generated code is built or imported."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T16:23:52.011Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-q7f2-jg6j-r867)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/orval-labs/orval/security/advisories/GHSA-q7f2-jg6j-r867"
},
{
"tags": [
"patch",
"issue-tracking"
],
"url": "https://github.com/orval-labs/orval/pull/3995"
},
{
"tags": [
"patch"
],
"url": "https://github.com/orval-labs/orval/commit/d346d94a660e50a2f8d0f7c17fee2c4c69d8dc23"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/orval-labs/orval/blob/v8.28.1/packages/effect/src/index.ts#L298-L302"
},
{
"tags": [
"product"
],
"url": "https://github.com/orval-labs/orval"
},
{
"name": "VulnCheck Advisory: orval @orval/effect 8.14.0 through 8.28.1 Code Injection",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/orval-orval-effect-8.14.0-through-8.28.1-code-injection"
}
],
"title": "orval @orval/effect 8.14.0 through 8.28.1 Code Injection",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-96755",
"datePublished": "2026-09-23T16:23:52.011Z",
"dateReserved": "2026-09-23T15:58:25.066Z",
"dateUpdated": "2026-09-23T16:47:31.442Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-96754 (GCVE-0-2026-96754)
Vulnerability from nvd – Published: 2026-09-23 16:23 – Updated: 2026-09-29 02:00
VLAI
EPSS
VEX
Title
orval @orval/hono before 8.29.0 Code Injection via OpenAPI Path
Summary
orval versions before 8.29.0 contain a code injection vulnerability in the @orval/hono generator that fails to escape OpenAPI path values in single-quoted route literals. Attackers can craft an OpenAPI document with an apostrophe in a static path segment to inject arbitrary JavaScript code that executes when the generated TypeScript module is imported.
Severity
9.8 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-29 01:59 UTC
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/orval-labs/orval/security/advi… | vendor-advisory |
| https://github.com/orval-labs/orval/pull/4006 | patchissue-tracking |
| https://github.com/orval-labs/orval/commit/155a5b… | patch |
| https://github.com/orval-labs/orval/commit/d346d9… | patch |
| https://github.com/orval-labs/orval/blob/v8.28.1/… | technical-description |
| https://github.com/orval-labs/orval | product |
| https://www.vulncheck.com/advisories/orval-orval-… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| orval-labs | orval |
Affected:
0 , < 8.29.0
(semver)
Unaffected: 8.29.0 (semver) cpe:2.3:a:orval:orval:*:*:*:*:*:*:*:* |
Date Public
2026-09-06 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-96754",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-29T01:59:42.551291Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T02:00:26.855Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/orval-labs/orval/security/advisories/GHSA-g4mf-q5hw-f9j9"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/orval",
"product": "orval",
"vendor": "orval-labs",
"versions": [
{
"lessThan": "8.29.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "8.29.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:orval:orval:*:*:*:*:*:*:*:*",
"versionEndExcluding": "8.29.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Enrik Mustafa"
}
],
"datePublic": "2026-09-06T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "orval versions before 8.29.0 contain a code injection vulnerability in the @orval/hono generator that fails to escape OpenAPI path values in single-quoted route literals. Attackers can craft an OpenAPI document with an apostrophe in a static path segment to inject arbitrary JavaScript code that executes when the generated TypeScript module is imported."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T16:23:51.012Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-g4mf-q5hw-f9j9)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/orval-labs/orval/security/advisories/GHSA-g4mf-q5hw-f9j9"
},
{
"tags": [
"patch",
"issue-tracking"
],
"url": "https://github.com/orval-labs/orval/pull/4006"
},
{
"tags": [
"patch"
],
"url": "https://github.com/orval-labs/orval/commit/155a5b7a38ff6886020cbc4c292db57c2793e6b6"
},
{
"tags": [
"patch"
],
"url": "https://github.com/orval-labs/orval/commit/d346d94a660e50a2f8d0f7c17fee2c4c69d8dc23"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/orval-labs/orval/blob/v8.28.1/packages/hono/src/index.ts#L169-L175"
},
{
"tags": [
"product"
],
"url": "https://github.com/orval-labs/orval"
},
{
"name": "VulnCheck Advisory: orval @orval/hono before 8.29.0 Code Injection via OpenAPI Path",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/orval-orval-hono-before-8.29.0-code-injection-via-openapi-path"
}
],
"title": "orval @orval/hono before 8.29.0 Code Injection via OpenAPI Path",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-96754",
"datePublished": "2026-09-23T16:23:51.012Z",
"dateReserved": "2026-09-23T15:58:24.561Z",
"dateUpdated": "2026-09-29T02:00:26.855Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72717 (GCVE-0-2026-72717)
Vulnerability from nvd – Published: 2026-08-19 17:39 – Updated: 2026-08-21 19:44
VLAI
EPSS
VEX
Title
Orval: Import-time RCE via schema default -> zod module-level template literal
Summary
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a ${...} expression or backtick in a schema default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permits attacker-controlled JavaScript to be evaluated when the generated zod schema module is imported, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/zod/src/index.ts function formatDefaultValue. This issue is fixed in version 8.21.0.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-21 19:44 UTC
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/orval-labs/orval/security/advi… | x_refsource_CONFIRM |
| https://github.com/orval-labs/orval/pull/3692 | x_refsource_MISC |
| https://github.com/orval-labs/orval/commit/8ef1bf… | x_refsource_MISC |
| https://github.com/orval-labs/orval/releases/tag/… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| orval-labs | orval |
Affected:
< 8.21.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72717",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-21T19:44:08.757181Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-21T19:44:34.681Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/orval-labs/orval/security/advisories/GHSA-w727-8j6c-2rj4"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "orval",
"vendor": "orval-labs",
"versions": [
{
"status": "affected",
"version": "\u003c 8.21.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a ${...} expression or backtick in a schema default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permits attacker-controlled JavaScript to be evaluated when the generated zod schema module is imported, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/zod/src/index.ts function formatDefaultValue. This issue is fixed in version 8.21.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-116",
"description": "CWE-116: Improper Encoding or Escaping of Output",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-1336",
"description": "CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T17:39:23.125Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/orval-labs/orval/security/advisories/GHSA-w727-8j6c-2rj4",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/orval-labs/orval/security/advisories/GHSA-w727-8j6c-2rj4"
},
{
"name": "https://github.com/orval-labs/orval/pull/3692",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/orval-labs/orval/pull/3692"
},
{
"name": "https://github.com/orval-labs/orval/commit/8ef1bfdf3f9bcaf9dabfbe2e42887f1c0e159ab6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/orval-labs/orval/commit/8ef1bfdf3f9bcaf9dabfbe2e42887f1c0e159ab6"
},
{
"name": "https://github.com/orval-labs/orval/releases/tag/v8.21.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/orval-labs/orval/releases/tag/v8.21.0"
}
],
"source": {
"advisory": "GHSA-w727-8j6c-2rj4",
"discovery": "UNKNOWN"
},
"title": "Orval: Import-time RCE via schema default -\u003e zod module-level template literal"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-72717",
"datePublished": "2026-08-19T17:39:23.125Z",
"dateReserved": "2026-08-10T13:48:09.545Z",
"dateUpdated": "2026-08-21T19:44:34.681Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72716 (GCVE-0-2026-72716)
Vulnerability from nvd – Published: 2026-08-19 17:33 – Updated: 2026-08-19 17:48
VLAI
EPSS
VEX
Title
Orval: Import-time RCE via query-parameter default -> zod module-level template literal
Summary
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a ${...} expression or backtick in a query parameter default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permits attacker-controlled JavaScript to be evaluated when the generated zod schema module is imported, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/zod/src/index.ts function formatDefaultValue. This issue is fixed in version 8.21.0.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-19 17:48 UTC
CWE
- CWE-1336 - Improper Neutralization of Special Elements Used in a Template Engine
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/orval-labs/orval/security/advi… | x_refsource_CONFIRM |
| https://github.com/orval-labs/orval/pull/3692 | x_refsource_MISC |
| https://github.com/orval-labs/orval/commit/8ef1bf… | x_refsource_MISC |
| https://github.com/orval-labs/orval/releases/tag/… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| orval-labs | orval |
Affected:
< 8.21.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72716",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-19T17:48:07.984853Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T17:48:14.929Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/orval-labs/orval/security/advisories/GHSA-p4cg-3328-rvfg"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "orval",
"vendor": "orval-labs",
"versions": [
{
"status": "affected",
"version": "\u003c 8.21.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a ${...} expression or backtick in a query parameter default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permits attacker-controlled JavaScript to be evaluated when the generated zod schema module is imported, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/zod/src/index.ts function formatDefaultValue. This issue is fixed in version 8.21.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1336",
"description": "CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T17:33:01.745Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/orval-labs/orval/security/advisories/GHSA-p4cg-3328-rvfg",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/orval-labs/orval/security/advisories/GHSA-p4cg-3328-rvfg"
},
{
"name": "https://github.com/orval-labs/orval/pull/3692",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/orval-labs/orval/pull/3692"
},
{
"name": "https://github.com/orval-labs/orval/commit/8ef1bfdf3f9bcaf9dabfbe2e42887f1c0e159ab6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/orval-labs/orval/commit/8ef1bfdf3f9bcaf9dabfbe2e42887f1c0e159ab6"
},
{
"name": "https://github.com/orval-labs/orval/releases/tag/v8.21.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/orval-labs/orval/releases/tag/v8.21.0"
}
],
"source": {
"advisory": "GHSA-p4cg-3328-rvfg",
"discovery": "UNKNOWN"
},
"title": "Orval: Import-time RCE via query-parameter default -\u003e zod module-level template literal"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-72716",
"datePublished": "2026-08-19T17:33:01.745Z",
"dateReserved": "2026-08-10T13:48:09.545Z",
"dateUpdated": "2026-08-19T17:48:14.929Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-71871 (GCVE-0-2026-71871)
Vulnerability from nvd – Published: 2026-08-19 17:33 – Updated: 2026-08-21 21:49
VLAI
EPSS
VEX
Title
Orval: Import-time RCE via header-parameter default -> zod module-level template literal
Summary
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a ${...} expression or backtick in a header parameter default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permits attacker-controlled JavaScript to be evaluated when the generated zod schema module is imported, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/zod/src/index.ts function formatDefaultValue. This issue is fixed in version 8.21.0.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-21 21:10 UTC
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/orval-labs/orval/security/advi… | x_refsource_CONFIRM |
| https://github.com/orval-labs/orval/pull/3692 | x_refsource_MISC |
| https://github.com/orval-labs/orval/commit/8ef1bf… | x_refsource_MISC |
| https://github.com/orval-labs/orval/releases/tag/… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| orval-labs | orval |
Affected:
< 8.21.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-71871",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-21T21:10:47.820027Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-21T21:49:37.465Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "orval",
"vendor": "orval-labs",
"versions": [
{
"status": "affected",
"version": "\u003c 8.21.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a ${...} expression or backtick in a header parameter default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permits attacker-controlled JavaScript to be evaluated when the generated zod schema module is imported, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/zod/src/index.ts function formatDefaultValue. This issue is fixed in version 8.21.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-116",
"description": "CWE-116: Improper Encoding or Escaping of Output",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-1336",
"description": "CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T17:33:56.011Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/orval-labs/orval/security/advisories/GHSA-8j6p-r8jg-mxqh",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/orval-labs/orval/security/advisories/GHSA-8j6p-r8jg-mxqh"
},
{
"name": "https://github.com/orval-labs/orval/pull/3692",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/orval-labs/orval/pull/3692"
},
{
"name": "https://github.com/orval-labs/orval/commit/8ef1bfdf3f9bcaf9dabfbe2e42887f1c0e159ab6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/orval-labs/orval/commit/8ef1bfdf3f9bcaf9dabfbe2e42887f1c0e159ab6"
},
{
"name": "https://github.com/orval-labs/orval/releases/tag/v8.21.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/orval-labs/orval/releases/tag/v8.21.0"
}
],
"source": {
"advisory": "GHSA-8j6p-r8jg-mxqh",
"discovery": "UNKNOWN"
},
"title": "Orval: Import-time RCE via header-parameter default -\u003e zod module-level template literal"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-71871",
"datePublished": "2026-08-19T17:33:56.011Z",
"dateReserved": "2026-08-07T18:26:53.524Z",
"dateUpdated": "2026-08-21T21:49:37.465Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-71869 (GCVE-0-2026-71869)
Vulnerability from nvd – Published: 2026-08-19 17:36 – Updated: 2026-08-25 03:32
VLAI
EPSS
VEX
Title
Orval: Import-time RCE via array-items default -> zod module-level template literal
Summary
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a ${...} expression or backtick in an array item default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permits attacker-controlled JavaScript to be evaluated when the generated zod schema module is imported, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/zod/src/index.ts function formatDefaultValue. This issue is fixed in version 8.21.0.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-25 03:32 UTC
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/orval-labs/orval/security/advi… | x_refsource_CONFIRM |
| https://github.com/orval-labs/orval/pull/3692 | x_refsource_MISC |
| https://github.com/orval-labs/orval/commit/8ef1bf… | x_refsource_MISC |
| https://github.com/orval-labs/orval/releases/tag/… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| orval-labs | orval |
Affected:
< 8.21.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-71869",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-25T03:32:15.337907Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T03:32:48.556Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/orval-labs/orval/security/advisories/GHSA-2h9g-j24r-h63g"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "orval",
"vendor": "orval-labs",
"versions": [
{
"status": "affected",
"version": "\u003c 8.21.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a ${...} expression or backtick in an array item default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permits attacker-controlled JavaScript to be evaluated when the generated zod schema module is imported, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/zod/src/index.ts function formatDefaultValue. This issue is fixed in version 8.21.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-116",
"description": "CWE-116: Improper Encoding or Escaping of Output",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-1336",
"description": "CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T17:36:06.800Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/orval-labs/orval/security/advisories/GHSA-2h9g-j24r-h63g",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/orval-labs/orval/security/advisories/GHSA-2h9g-j24r-h63g"
},
{
"name": "https://github.com/orval-labs/orval/pull/3692",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/orval-labs/orval/pull/3692"
},
{
"name": "https://github.com/orval-labs/orval/commit/8ef1bfdf3f9bcaf9dabfbe2e42887f1c0e159ab6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/orval-labs/orval/commit/8ef1bfdf3f9bcaf9dabfbe2e42887f1c0e159ab6"
},
{
"name": "https://github.com/orval-labs/orval/releases/tag/v8.21.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/orval-labs/orval/releases/tag/v8.21.0"
}
],
"source": {
"advisory": "GHSA-2h9g-j24r-h63g",
"discovery": "UNKNOWN"
},
"title": "Orval: Import-time RCE via array-items default -\u003e zod module-level template literal"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-71869",
"datePublished": "2026-08-19T17:36:06.800Z",
"dateReserved": "2026-08-07T18:26:53.524Z",
"dateUpdated": "2026-08-25T03:32:48.556Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-71868 (GCVE-0-2026-71868)
Vulnerability from nvd – Published: 2026-08-19 17:37 – Updated: 2026-08-21 19:43
VLAI
EPSS
VEX
Title
Orval: Import-time RCE via enum-typed default -> zod module-level template literal
Summary
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a ${...} expression or backtick in an enum default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permits attacker-controlled JavaScript to be evaluated when the generated zod schema module is imported, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/zod/src/index.ts function formatDefaultValue. This issue is fixed in version 8.21.0.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-21 19:43 UTC
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/orval-labs/orval/security/advi… | x_refsource_CONFIRM |
| https://github.com/orval-labs/orval/pull/3692 | x_refsource_MISC |
| https://github.com/orval-labs/orval/commit/8ef1bf… | x_refsource_MISC |
| https://github.com/orval-labs/orval/releases/tag/… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| orval-labs | orval |
Affected:
< 8.21.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-71868",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-21T19:43:10.477229Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-21T19:43:39.471Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/orval-labs/orval/security/advisories/GHSA-3575-w9fc-c2j6"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "orval",
"vendor": "orval-labs",
"versions": [
{
"status": "affected",
"version": "\u003c 8.21.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a ${...} expression or backtick in an enum default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permits attacker-controlled JavaScript to be evaluated when the generated zod schema module is imported, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/zod/src/index.ts function formatDefaultValue. This issue is fixed in version 8.21.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-1336",
"description": "CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T17:37:34.092Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/orval-labs/orval/security/advisories/GHSA-3575-w9fc-c2j6",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/orval-labs/orval/security/advisories/GHSA-3575-w9fc-c2j6"
},
{
"name": "https://github.com/orval-labs/orval/pull/3692",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/orval-labs/orval/pull/3692"
},
{
"name": "https://github.com/orval-labs/orval/commit/8ef1bfdf3f9bcaf9dabfbe2e42887f1c0e159ab6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/orval-labs/orval/commit/8ef1bfdf3f9bcaf9dabfbe2e42887f1c0e159ab6"
},
{
"name": "https://github.com/orval-labs/orval/releases/tag/v8.21.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/orval-labs/orval/releases/tag/v8.21.0"
}
],
"source": {
"advisory": "GHSA-3575-w9fc-c2j6",
"discovery": "UNKNOWN"
},
"title": "Orval: Import-time RCE via enum-typed default -\u003e zod module-level template literal"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-71868",
"datePublished": "2026-08-19T17:37:34.092Z",
"dateReserved": "2026-08-07T18:26:53.524Z",
"dateUpdated": "2026-08-21T19:43:39.471Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-71867 (GCVE-0-2026-71867)
Vulnerability from nvd – Published: 2026-08-19 17:38 – Updated: 2026-08-19 18:21
VLAI
EPSS
VEX
Title
Orval: RCE via schema property name -> computed-property-key injection in the MSW mock generator
Summary
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a single quote in a schema property name is emitted into single-quoted object keys in generated MSW mock factories without safe encoding. This permits attacker-controlled JavaScript to be evaluated when the generated mock factory is called by tests or an MSW handler, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/core/src/getters/keys.ts function getKey and MSW mock generation. This issue is fixed in version 8.21.0.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-19 18:21 UTC
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/orval-labs/orval/security/advi… | x_refsource_CONFIRM |
| https://github.com/orval-labs/orval/pull/3692 | x_refsource_MISC |
| https://github.com/orval-labs/orval/commit/8ef1bf… | x_refsource_MISC |
| https://github.com/orval-labs/orval/releases/tag/… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| orval-labs | orval |
Affected:
< 8.21.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-71867",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-19T18:21:14.097525Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T18:21:51.339Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/orval-labs/orval/security/advisories/GHSA-2w86-xfrc-g85r"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "orval",
"vendor": "orval-labs",
"versions": [
{
"status": "affected",
"version": "\u003c 8.21.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a single quote in a schema property name is emitted into single-quoted object keys in generated MSW mock factories without safe encoding. This permits attacker-controlled JavaScript to be evaluated when the generated mock factory is called by tests or an MSW handler, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/core/src/getters/keys.ts function getKey and MSW mock generation. This issue is fixed in version 8.21.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-95",
"description": "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (\u0027Eval Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T17:38:36.371Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/orval-labs/orval/security/advisories/GHSA-2w86-xfrc-g85r",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/orval-labs/orval/security/advisories/GHSA-2w86-xfrc-g85r"
},
{
"name": "https://github.com/orval-labs/orval/pull/3692",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/orval-labs/orval/pull/3692"
},
{
"name": "https://github.com/orval-labs/orval/commit/8ef1bfdf3f9bcaf9dabfbe2e42887f1c0e159ab6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/orval-labs/orval/commit/8ef1bfdf3f9bcaf9dabfbe2e42887f1c0e159ab6"
},
{
"name": "https://github.com/orval-labs/orval/releases/tag/v8.21.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/orval-labs/orval/releases/tag/v8.21.0"
}
],
"source": {
"advisory": "GHSA-2w86-xfrc-g85r",
"discovery": "UNKNOWN"
},
"title": "Orval: RCE via schema property name -\u003e computed-property-key injection in the MSW mock generator"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-71867",
"datePublished": "2026-08-19T17:38:36.371Z",
"dateReserved": "2026-08-07T18:26:53.524Z",
"dateUpdated": "2026-08-19T18:21:51.339Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-71866 (GCVE-0-2026-71866)
Vulnerability from nvd – Published: 2026-08-19 17:27 – Updated: 2026-08-19 18:03
VLAI
EPSS
VEX
Title
Orval: Import-time RCE via schema property name -> computed-property-key injection in the zod client
Summary
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. From version 8.19.0 until 8.21.0, a double quote in a schema property name is emitted into the generated zod.object({...}) schema without safe encoding. This permits attacker-controlled JavaScript to be evaluated when the generated zod schema module is imported, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/zod/src/index.ts and zod object-key generation. This issue is fixed in version 8.21.0.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-19 18:03 UTC
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/orval-labs/orval/security/advi… | x_refsource_CONFIRM |
| https://github.com/orval-labs/orval/pull/3692 | x_refsource_MISC |
| https://github.com/orval-labs/orval/commit/8ef1bf… | x_refsource_MISC |
| https://github.com/orval-labs/orval/releases/tag/… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| orval-labs | orval |
Affected:
< 8.21.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-71866",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-19T18:03:07.666085Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T18:03:13.730Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/orval-labs/orval/security/advisories/GHSA-6mr6-jvcr-2f25"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "orval",
"vendor": "orval-labs",
"versions": [
{
"status": "affected",
"version": "\u003c 8.21.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. From version 8.19.0 until 8.21.0, a double quote in a schema property name is emitted into the generated zod.object({...}) schema without safe encoding. This permits attacker-controlled JavaScript to be evaluated when the generated zod schema module is imported, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/zod/src/index.ts and zod object-key generation. This issue is fixed in version 8.21.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-95",
"description": "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (\u0027Eval Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T17:27:28.222Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/orval-labs/orval/security/advisories/GHSA-6mr6-jvcr-2f25",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/orval-labs/orval/security/advisories/GHSA-6mr6-jvcr-2f25"
},
{
"name": "https://github.com/orval-labs/orval/pull/3692",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/orval-labs/orval/pull/3692"
},
{
"name": "https://github.com/orval-labs/orval/commit/8ef1bfdf3f9bcaf9dabfbe2e42887f1c0e159ab6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/orval-labs/orval/commit/8ef1bfdf3f9bcaf9dabfbe2e42887f1c0e159ab6"
},
{
"name": "https://github.com/orval-labs/orval/releases/tag/v8.21.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/orval-labs/orval/releases/tag/v8.21.0"
}
],
"source": {
"advisory": "GHSA-6mr6-jvcr-2f25",
"discovery": "UNKNOWN"
},
"title": "Orval: Import-time RCE via schema property name -\u003e computed-property-key injection in the zod client"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-71866",
"datePublished": "2026-08-19T17:27:28.222Z",
"dateReserved": "2026-08-07T18:26:53.524Z",
"dateUpdated": "2026-08-19T18:03:13.730Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-71865 (GCVE-0-2026-71865)
Vulnerability from nvd – Published: 2026-08-19 17:36 – Updated: 2026-08-21 21:49
VLAI
EPSS
VEX
Title
Orval: Import-time RCE via query parameter name -> computed-property-key injection in the zod cli
Summary
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a double quote in a query parameter name is emitted into the generated request-validation zod.object({...}) schema without safe encoding. This permits attacker-controlled JavaScript to be evaluated when the generated zod schema module is imported, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/zod/src/index.ts and query request-validation generation. This issue is fixed in version 8.21.0.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-21 21:10 UTC
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/orval-labs/orval/security/advi… | x_refsource_CONFIRM |
| https://github.com/orval-labs/orval/pull/3692 | x_refsource_MISC |
| https://github.com/orval-labs/orval/commit/8ef1bf… | x_refsource_MISC |
| https://github.com/orval-labs/orval/releases/tag/… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| orval-labs | orval |
Affected:
< 8.21.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-71865",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-21T21:10:45.408281Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-21T21:49:30.476Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "orval",
"vendor": "orval-labs",
"versions": [
{
"status": "affected",
"version": "\u003c 8.21.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a double quote in a query parameter name is emitted into the generated request-validation zod.object({...}) schema without safe encoding. This permits attacker-controlled JavaScript to be evaluated when the generated zod schema module is imported, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/zod/src/index.ts and query request-validation generation. This issue is fixed in version 8.21.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-95",
"description": "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (\u0027Eval Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-116",
"description": "CWE-116: Improper Encoding or Escaping of Output",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T17:36:47.668Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/orval-labs/orval/security/advisories/GHSA-653q-5476-x79g",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/orval-labs/orval/security/advisories/GHSA-653q-5476-x79g"
},
{
"name": "https://github.com/orval-labs/orval/pull/3692",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/orval-labs/orval/pull/3692"
},
{
"name": "https://github.com/orval-labs/orval/commit/8ef1bfdf3f9bcaf9dabfbe2e42887f1c0e159ab6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/orval-labs/orval/commit/8ef1bfdf3f9bcaf9dabfbe2e42887f1c0e159ab6"
},
{
"name": "https://github.com/orval-labs/orval/releases/tag/v8.21.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/orval-labs/orval/releases/tag/v8.21.0"
}
],
"source": {
"advisory": "GHSA-653q-5476-x79g",
"discovery": "UNKNOWN"
},
"title": "Orval: Import-time RCE via query parameter name -\u003e computed-property-key injection in the zod cli"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-71865",
"datePublished": "2026-08-19T17:36:47.668Z",
"dateReserved": "2026-08-07T18:26:53.524Z",
"dateUpdated": "2026-08-21T21:49:30.476Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-71864 (GCVE-0-2026-71864)
Vulnerability from nvd – Published: 2026-08-19 17:34 – Updated: 2026-08-25 02:21
VLAI
EPSS
VEX
Title
Orval: Import-time RCE via header parameter name -> computed-property-key injection in the zod client
Summary
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a double quote in a header parameter name is emitted into the generated request-validation zod.object({...}) schema without safe encoding. This permits attacker-controlled JavaScript to be evaluated when the generated zod schema module is imported, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/zod/src/index.ts and header request-validation generation. This issue is fixed in version 8.21.0.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-25 02:20 UTC
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/orval-labs/orval/security/advi… | x_refsource_CONFIRM |
| https://github.com/orval-labs/orval/pull/3692 | x_refsource_MISC |
| https://github.com/orval-labs/orval/commit/8ef1bf… | x_refsource_MISC |
| https://github.com/orval-labs/orval/releases/tag/… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| orval-labs | orval |
Affected:
< 8.21.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-71864",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-25T02:20:17.436822Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T02:21:34.265Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/orval-labs/orval/security/advisories/GHSA-6437-gxhq-pqv8"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "orval",
"vendor": "orval-labs",
"versions": [
{
"status": "affected",
"version": "\u003c 8.21.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a double quote in a header parameter name is emitted into the generated request-validation zod.object({...}) schema without safe encoding. This permits attacker-controlled JavaScript to be evaluated when the generated zod schema module is imported, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/zod/src/index.ts and header request-validation generation. This issue is fixed in version 8.21.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-95",
"description": "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (\u0027Eval Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-116",
"description": "CWE-116: Improper Encoding or Escaping of Output",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T17:34:55.340Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/orval-labs/orval/security/advisories/GHSA-6437-gxhq-pqv8",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/orval-labs/orval/security/advisories/GHSA-6437-gxhq-pqv8"
},
{
"name": "https://github.com/orval-labs/orval/pull/3692",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/orval-labs/orval/pull/3692"
},
{
"name": "https://github.com/orval-labs/orval/commit/8ef1bfdf3f9bcaf9dabfbe2e42887f1c0e159ab6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/orval-labs/orval/commit/8ef1bfdf3f9bcaf9dabfbe2e42887f1c0e159ab6"
},
{
"name": "https://github.com/orval-labs/orval/releases/tag/v8.21.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/orval-labs/orval/releases/tag/v8.21.0"
}
],
"source": {
"advisory": "GHSA-6437-gxhq-pqv8",
"discovery": "UNKNOWN"
},
"title": "Orval: Import-time RCE via header parameter name -\u003e computed-property-key injection in the zod client"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-71864",
"datePublished": "2026-08-19T17:34:55.340Z",
"dateReserved": "2026-08-07T18:26:53.524Z",
"dateUpdated": "2026-08-25T02:21:34.265Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-62682 (GCVE-0-2026-62682)
Vulnerability from nvd – Published: 2026-08-19 17:40 – Updated: 2026-08-19 18:19
VLAI
EPSS
VEX
Title
Orval: RCE via servers[].url -> unescaped request-URL template literal (with getBaseUrlFromSpecification)
Summary
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, an unescaped backtick in servers[0].url is emitted into request URL template literals generated when output.baseUrl.getBaseUrlFromSpecification is enabled without safe encoding. This permits attacker-controlled JavaScript to be evaluated when a generated request or URL-builder function is called, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/core/src/getters/route.ts function getFullRoute. This issue is fixed in version 8.21.0.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-19 18:18 UTC
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/orval-labs/orval/security/advi… | x_refsource_CONFIRM |
| https://github.com/orval-labs/orval/pull/3692 | x_refsource_MISC |
| https://github.com/orval-labs/orval/commit/8ef1bf… | x_refsource_MISC |
| https://github.com/orval-labs/orval/releases/tag/… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| orval-labs | orval |
Affected:
< 8.21.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-62682",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-19T18:18:29.754822Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T18:19:27.462Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/orval-labs/orval/security/advisories/GHSA-88f2-fpv8-89q2"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "orval",
"vendor": "orval-labs",
"versions": [
{
"status": "affected",
"version": "\u003c 8.21.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, an unescaped backtick in servers[0].url is emitted into request URL template literals generated when output.baseUrl.getBaseUrlFromSpecification is enabled without safe encoding. This permits attacker-controlled JavaScript to be evaluated when a generated request or URL-builder function is called, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/core/src/getters/route.ts function getFullRoute. This issue is fixed in version 8.21.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-116",
"description": "CWE-116: Improper Encoding or Escaping of Output",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-1336",
"description": "CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T17:40:17.061Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/orval-labs/orval/security/advisories/GHSA-88f2-fpv8-89q2",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/orval-labs/orval/security/advisories/GHSA-88f2-fpv8-89q2"
},
{
"name": "https://github.com/orval-labs/orval/pull/3692",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/orval-labs/orval/pull/3692"
},
{
"name": "https://github.com/orval-labs/orval/commit/8ef1bfdf3f9bcaf9dabfbe2e42887f1c0e159ab6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/orval-labs/orval/commit/8ef1bfdf3f9bcaf9dabfbe2e42887f1c0e159ab6"
},
{
"name": "https://github.com/orval-labs/orval/releases/tag/v8.21.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/orval-labs/orval/releases/tag/v8.21.0"
}
],
"source": {
"advisory": "GHSA-88f2-fpv8-89q2",
"discovery": "UNKNOWN"
},
"title": "Orval: RCE via servers[].url -\u003e unescaped request-URL template literal (with getBaseUrlFromSpecification)"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-62682",
"datePublished": "2026-08-19T17:40:17.061Z",
"dateReserved": "2026-07-14T20:22:04.395Z",
"dateUpdated": "2026-08-19T18:19:27.462Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-62681 (GCVE-0-2026-62681)
Vulnerability from nvd – Published: 2026-08-19 17:31 – Updated: 2026-08-21 19:42
VLAI
EPSS
VEX
Title
Orval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout)
Summary
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, an unescaped backtick in an OpenAPI path is emitted into request URL template literals generated for axios, fetch, react-query, and SWR clients without safe encoding. This permits attacker-controlled JavaScript to be evaluated when a generated request, URL-builder, or query-key function is called, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/core/src/getters/route.ts and route generation consumers. This issue is fixed in version 8.21.0.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-21 19:41 UTC
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/orval-labs/orval/security/advi… | x_refsource_CONFIRM |
| https://github.com/orval-labs/orval/pull/3692 | x_refsource_MISC |
| https://github.com/orval-labs/orval/commit/8ef1bf… | x_refsource_MISC |
| https://github.com/orval-labs/orval/releases/tag/… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| orval-labs | orval |
Affected:
< 8.21.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-62681",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-21T19:41:40.276752Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-21T19:42:09.266Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/orval-labs/orval/security/advisories/GHSA-fg9p-mrxr-hvq7"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "orval",
"vendor": "orval-labs",
"versions": [
{
"status": "affected",
"version": "\u003c 8.21.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, an unescaped backtick in an OpenAPI path is emitted into request URL template literals generated for axios, fetch, react-query, and SWR clients without safe encoding. This permits attacker-controlled JavaScript to be evaluated when a generated request, URL-builder, or query-key function is called, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/core/src/getters/route.ts and route generation consumers. This issue is fixed in version 8.21.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-116",
"description": "CWE-116: Improper Encoding or Escaping of Output",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-1336",
"description": "CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T17:31:02.756Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/orval-labs/orval/security/advisories/GHSA-fg9p-mrxr-hvq7",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/orval-labs/orval/security/advisories/GHSA-fg9p-mrxr-hvq7"
},
{
"name": "https://github.com/orval-labs/orval/pull/3692",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/orval-labs/orval/pull/3692"
},
{
"name": "https://github.com/orval-labs/orval/commit/8ef1bfdf3f9bcaf9dabfbe2e42887f1c0e159ab6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/orval-labs/orval/commit/8ef1bfdf3f9bcaf9dabfbe2e42887f1c0e159ab6"
},
{
"name": "https://github.com/orval-labs/orval/releases/tag/v8.21.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/orval-labs/orval/releases/tag/v8.21.0"
}
],
"source": {
"advisory": "GHSA-fg9p-mrxr-hvq7",
"discovery": "UNKNOWN"
},
"title": "Orval: RCE via OpenAPI path -\u003e unescaped request-URL template literal (backtick breakout)"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-62681",
"datePublished": "2026-08-19T17:31:02.756Z",
"dateReserved": "2026-07-14T20:22:04.395Z",
"dateUpdated": "2026-08-21T19:42:09.266Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-62680 (GCVE-0-2026-62680)
Vulnerability from nvd – Published: 2026-08-19 17:42 – Updated: 2026-08-19 18:06
VLAI
EPSS
VEX
Title
Orval: Generation-time SSRF + remote/local file inclusion via unrestricted $ref
Summary
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.22.0, Orval resolves remote and local external $ref values without an allowlist or confinement to the input directory. Processing an attacker-controlled OpenAPI description can cause requests from the developer or CI host to attacker-selected or internal HTTP services, read absolute or out-of-tree local files, and inline untrusted remote schemas into generated clients. The affected code is packages/orval/src/import-specs.ts external reference loading. This issue is fixed in version 8.22.0.
Severity
7.1 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-19 18:06 UTC
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/orval-labs/orval/security/advi… | x_refsource_CONFIRM |
| https://github.com/orval-labs/orval/pull/3723 | x_refsource_MISC |
| https://github.com/orval-labs/orval/commit/23786c… | x_refsource_MISC |
| https://github.com/orval-labs/orval/releases/tag/… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| orval-labs | orval |
Affected:
< 8.22.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-62680",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-19T18:06:42.406731Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T18:06:47.948Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/orval-labs/orval/security/advisories/GHSA-cxq5-97v7-87j8"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "orval",
"vendor": "orval-labs",
"versions": [
{
"status": "affected",
"version": "\u003c 8.22.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.22.0, Orval resolves remote and local external $ref values without an allowlist or confinement to the input directory. Processing an attacker-controlled OpenAPI description can cause requests from the developer or CI host to attacker-selected or internal HTTP services, read absolute or out-of-tree local files, and inline untrusted remote schemas into generated clients. The affected code is packages/orval/src/import-specs.ts external reference loading. This issue is fixed in version 8.22.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-829",
"description": "CWE-829: Inclusion of Functionality from Untrusted Control Sphere",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T17:42:11.227Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/orval-labs/orval/security/advisories/GHSA-cxq5-97v7-87j8",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/orval-labs/orval/security/advisories/GHSA-cxq5-97v7-87j8"
},
{
"name": "https://github.com/orval-labs/orval/pull/3723",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/orval-labs/orval/pull/3723"
},
{
"name": "https://github.com/orval-labs/orval/commit/23786c056f4eba38c02bf2968677988dbbe4de10",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/orval-labs/orval/commit/23786c056f4eba38c02bf2968677988dbbe4de10"
},
{
"name": "https://github.com/orval-labs/orval/releases/tag/v8.22.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/orval-labs/orval/releases/tag/v8.22.0"
}
],
"source": {
"advisory": "GHSA-cxq5-97v7-87j8",
"discovery": "UNKNOWN"
},
"title": "Orval: Generation-time SSRF + remote/local file inclusion via unrestricted $ref"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-62680",
"datePublished": "2026-08-19T17:42:11.227Z",
"dateReserved": "2026-07-14T20:22:04.395Z",
"dateUpdated": "2026-08-19T18:06:47.948Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-96759 (GCVE-0-2026-96759)
Vulnerability from cvelistv5 – Published: 2026-09-23 16:23 – Updated: 2026-09-29 02:01
VLAI
EPSS
VEX
Title
orval before 8.29.0 Code Injection via operationId
Summary
orval before 8.29.0 fails to escape the operationId parameter when emitting it into generated TanStack Query mutator options metadata objects. Attackers can inject arbitrary JavaScript code through a crafted operationId in an OpenAPI specification that executes when generated hooks are called.
Severity
9.8 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-29 02:00 UTC
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/orval-labs/orval/security/advi… | vendor-advisory |
| https://github.com/orval-labs/orval/pull/4008 | patchissue-tracking |
| https://github.com/orval-labs/orval/commit/b28c53… | patch |
| https://github.com/orval-labs/orval/blob/v8.28.1/… | technical-description |
| https://github.com/orval-labs/orval | product |
| https://www.vulncheck.com/advisories/orval-before… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| orval-labs | orval |
Affected:
0 , < 8.29.0
(semver)
Unaffected: 8.29.0 (semver) cpe:2.3:a:orval:orval:*:*:*:*:*:*:*:* |
Date Public
2026-09-06 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-96759",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-29T02:00:51.406766Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T02:01:12.244Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/orval-labs/orval/security/advisories/GHSA-vv88-cm6j-665j"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/orval",
"product": "orval",
"vendor": "orval-labs",
"versions": [
{
"lessThan": "8.29.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "8.29.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:orval:orval:*:*:*:*:*:*:*:*",
"versionEndExcluding": "8.29.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Enrik Mustafa"
}
],
"datePublic": "2026-09-06T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "orval before 8.29.0 fails to escape the operationId parameter when emitting it into generated TanStack Query mutator options metadata objects. Attackers can inject arbitrary JavaScript code through a crafted operationId in an OpenAPI specification that executes when generated hooks are called."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T16:23:58.251Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-vv88-cm6j-665j)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/orval-labs/orval/security/advisories/GHSA-vv88-cm6j-665j"
},
{
"tags": [
"patch",
"issue-tracking"
],
"url": "https://github.com/orval-labs/orval/pull/4008"
},
{
"tags": [
"patch"
],
"url": "https://github.com/orval-labs/orval/commit/b28c53f3e0c06190e0f6ea136737e6316432448f"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/orval-labs/orval/blob/v8.28.1/packages/query/src/query-generator.ts#L784"
},
{
"tags": [
"product"
],
"url": "https://github.com/orval-labs/orval"
},
{
"name": "VulnCheck Advisory: orval before 8.29.0 Code Injection via operationId",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/orval-before-8.29.0-code-injection-via-operationid"
}
],
"title": "orval before 8.29.0 Code Injection via operationId",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-96759",
"datePublished": "2026-09-23T16:23:58.251Z",
"dateReserved": "2026-09-23T15:58:31.829Z",
"dateUpdated": "2026-09-29T02:01:12.244Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-96758 (GCVE-0-2026-96758)
Vulnerability from cvelistv5 – Published: 2026-09-23 16:23 – Updated: 2026-09-23 18:39
VLAI
EPSS
VEX
Title
orval @orval/core before 8.28.0 Code Injection via Form-Data
Summary
orval @orval/core before 8.28.0 contains a code injection vulnerability in the form-data serializer that fails to escape multipart property names in generated template literals. Attackers can inject ${...} expressions into OpenAPI schema property names that execute as live interpolation when the generated client builds FormData bodies with consumer process privileges.
Severity
9.8 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-23 18:38 UTC
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/orval-labs/orval/security/advi… | vendor-advisory |
| https://github.com/orval-labs/orval/pull/3988 | patchissue-tracking |
| https://github.com/orval-labs/orval/commit/975a76… | patch |
| https://github.com/orval-labs/orval/blob/v8.27.0/… | technical-description |
| https://github.com/orval-labs/orval | product |
| https://www.vulncheck.com/advisories/orval-orval-… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| orval-labs | orval |
Affected:
0 , < 8.28.0
(semver)
Unaffected: 8.28.0 (semver) cpe:2.3:a:orval:orval:*:*:*:*:*:*:*:* |
Date Public
2026-09-06 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-96758",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-23T18:38:59.966755Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T18:39:05.559Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/orval-labs/orval/security/advisories/GHSA-jwhm-6748-j6pq"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/orval",
"product": "orval",
"vendor": "orval-labs",
"versions": [
{
"lessThan": "8.28.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "8.28.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:orval:orval:*:*:*:*:*:*:*:*",
"versionEndExcluding": "8.28.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Enrik Mustafa"
}
],
"datePublic": "2026-09-06T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "orval @orval/core before 8.28.0 contains a code injection vulnerability in the form-data serializer that fails to escape multipart property names in generated template literals. Attackers can inject ${...} expressions into OpenAPI schema property names that execute as live interpolation when the generated client builds FormData bodies with consumer process privileges."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T16:23:56.849Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-jwhm-6748-j6pq)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/orval-labs/orval/security/advisories/GHSA-jwhm-6748-j6pq"
},
{
"tags": [
"patch",
"issue-tracking"
],
"url": "https://github.com/orval-labs/orval/pull/3988"
},
{
"tags": [
"patch"
],
"url": "https://github.com/orval-labs/orval/commit/975a769a76151354dead879feadfa3537ff065fe"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/orval-labs/orval/blob/v8.27.0/packages/core/src/getters/res-req-types.ts#L808"
},
{
"tags": [
"product"
],
"url": "https://github.com/orval-labs/orval"
},
{
"name": "VulnCheck Advisory: orval @orval/core before 8.28.0 Code Injection via Form-Data",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/orval-orval-core-before-8.28.0-code-injection-via-form-data"
}
],
"title": "orval @orval/core before 8.28.0 Code Injection via Form-Data",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-96758",
"datePublished": "2026-09-23T16:23:56.849Z",
"dateReserved": "2026-09-23T15:58:31.321Z",
"dateUpdated": "2026-09-23T18:39:05.559Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-96757 (GCVE-0-2026-96757)
Vulnerability from cvelistv5 – Published: 2026-09-23 16:23 – Updated: 2026-09-23 17:48
VLAI
EPSS
VEX
Title
orval before 8.29.0 Code Injection via unescaped OpenAPI media-type
Summary
orval before 8.29.0 fails to escape OpenAPI media-type keys when emitting them into single-quoted Content-Type string literals in generated code. Attackers can inject JavaScript through crafted media-type keys in OpenAPI specifications that executes when generated fetch operations or mock resolvers are invoked.
Severity
9.8 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-23 17:47 UTC
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://github.com/orval-labs/orval/security/advi… | vendor-advisory |
| https://github.com/orval-labs/orval/security/advi… | vendor-advisory |
| https://github.com/orval-labs/orval/pull/4007 | patchissue-tracking |
| https://github.com/orval-labs/orval/commit/43af28… | patch |
| https://github.com/orval-labs/orval/commit/a2d4af… | patch |
| https://github.com/orval-labs/orval/blob/v8.28.1/… | technical-description |
| https://github.com/orval-labs/orval | product |
| https://www.vulncheck.com/advisories/orval-before… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| orval-labs | orval |
Affected:
6.7.1 , < 8.29.0
(semver)
Unaffected: 8.29.0 (semver) cpe:2.3:a:orval:orval:*:*:*:*:*:*:*:* |
Date Public
2026-09-06 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-96757",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-23T17:47:51.520475Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T17:48:29.041Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/orval-labs/orval/security/advisories/GHSA-4q3x-rqfw-3x8p"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/orval",
"product": "orval",
"vendor": "orval-labs",
"versions": [
{
"lessThan": "8.29.0",
"status": "affected",
"version": "6.7.1",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "8.29.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:orval:orval:*:*:*:*:*:*:*:*",
"versionEndExcluding": "8.29.0",
"versionStartIncluding": "6.7.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Enrik Mustafa"
}
],
"datePublic": "2026-09-06T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "orval before 8.29.0 fails to escape OpenAPI media-type keys when emitting them into single-quoted Content-Type string literals in generated code. Attackers can inject JavaScript through crafted media-type keys in OpenAPI specifications that executes when generated fetch operations or mock resolvers are invoked."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T16:23:55.164Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-4q3x-rqfw-3x8p)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/orval-labs/orval/security/advisories/GHSA-4q3x-rqfw-3x8p"
},
{
"name": "GitHub Security Advisory (GHSA-rcpr-mq4m-jx9j)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/orval-labs/orval/security/advisories/GHSA-rcpr-mq4m-jx9j"
},
{
"tags": [
"patch",
"issue-tracking"
],
"url": "https://github.com/orval-labs/orval/pull/4007"
},
{
"tags": [
"patch"
],
"url": "https://github.com/orval-labs/orval/commit/43af282d62dca0ef3140023741fb768f6a718adb"
},
{
"tags": [
"patch"
],
"url": "https://github.com/orval-labs/orval/commit/a2d4af59f3b167dc8a7a65d15f51cdb89ebe2fe5"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/orval-labs/orval/blob/v8.28.1/packages/fetch/src/index.ts#L584"
},
{
"tags": [
"product"
],
"url": "https://github.com/orval-labs/orval"
},
{
"name": "VulnCheck Advisory: orval before 8.29.0 Code Injection via unescaped OpenAPI media-type",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/orval-before-8.29.0-code-injection-via-unescaped-openapi-media-type"
}
],
"title": "orval before 8.29.0 Code Injection via unescaped OpenAPI media-type",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-96757",
"datePublished": "2026-09-23T16:23:55.164Z",
"dateReserved": "2026-09-23T15:58:30.841Z",
"dateUpdated": "2026-09-23T17:48:29.041Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-96756 (GCVE-0-2026-96756)
Vulnerability from cvelistv5 – Published: 2026-09-23 16:23 – Updated: 2026-09-23 19:44
VLAI
EPSS
VEX
Title
orval before 8.30.0 Code Injection via Factory Generation
Summary
orval versions before 8.30.0 contain a code injection vulnerability in the @orval/core factory generator that fails to escape date default values in new Date() calls. Attackers can inject arbitrary expressions through apostrophes in OpenAPI schema defaults to execute code with the privileges of the consumer process when factoryMethods and useDates options are enabled.
Severity
8.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-23 18:11 UTC
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/orval-labs/orval/security/advi… | vendor-advisory |
| https://github.com/orval-labs/orval/pull/4038 | patchissue-tracking |
| https://github.com/orval-labs/orval/commit/b9b083… | patch |
| https://github.com/orval-labs/orval/blob/v8.29.0/… | technical-description |
| https://github.com/orval-labs/orval | product |
| https://www.vulncheck.com/advisories/orval-before… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| orval-labs | orval |
Affected:
0 , < 8.30.0
(semver)
Unaffected: 8.30.0 (semver) cpe:2.3:a:orval:orval:*:*:*:*:*:*:*:* |
Date Public
2026-09-07 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-96756",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-23T18:11:23.190187Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T19:44:36.697Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/orval",
"product": "orval",
"vendor": "orval-labs",
"versions": [
{
"lessThan": "8.30.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "8.30.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:orval:orval:*:*:*:*:*:*:*:*",
"versionEndExcluding": "8.30.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Enrik Mustafa"
}
],
"datePublic": "2026-09-07T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "orval versions before 8.30.0 contain a code injection vulnerability in the @orval/core factory generator that fails to escape date default values in new Date() calls. Attackers can inject arbitrary expressions through apostrophes in OpenAPI schema defaults to execute code with the privileges of the consumer process when factoryMethods and useDates options are enabled."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 9.2,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T16:23:53.491Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-wx66-36r6-v5g7)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/orval-labs/orval/security/advisories/GHSA-wx66-36r6-v5g7"
},
{
"tags": [
"patch",
"issue-tracking"
],
"url": "https://github.com/orval-labs/orval/pull/4038"
},
{
"tags": [
"patch"
],
"url": "https://github.com/orval-labs/orval/commit/b9b083576943c683540200eb957feced57dddc1a"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/orval-labs/orval/blob/v8.29.0/packages/core/src/generators/factory.ts#L493"
},
{
"tags": [
"product"
],
"url": "https://github.com/orval-labs/orval"
},
{
"name": "VulnCheck Advisory: orval before 8.30.0 Code Injection via Factory Generation",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/orval-before-8.30.0-code-injection-via-factory-generation"
}
],
"title": "orval before 8.30.0 Code Injection via Factory Generation",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-96756",
"datePublished": "2026-09-23T16:23:53.491Z",
"dateReserved": "2026-09-23T15:58:25.631Z",
"dateUpdated": "2026-09-23T19:44:36.697Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-96755 (GCVE-0-2026-96755)
Vulnerability from cvelistv5 – Published: 2026-09-23 16:23 – Updated: 2026-09-23 16:47
VLAI
EPSS
VEX
Title
orval @orval/effect 8.14.0 through 8.28.1 Code Injection
Summary
orval versions 8.14.0 through 8.28.1 contain a code injection vulnerability in the @orval/effect generator that converts OpenAPI schema defaults into template literals. Attackers can inject arbitrary JavaScript expressions via schema defaults containing ${...} syntax, which are executed at module scope when the generated code is built or imported.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-23 16:47 UTC
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/orval-labs/orval/security/advi… | vendor-advisory |
| https://github.com/orval-labs/orval/pull/3995 | patchissue-tracking |
| https://github.com/orval-labs/orval/commit/d346d9… | patch |
| https://github.com/orval-labs/orval/blob/v8.28.1/… | technical-description |
| https://github.com/orval-labs/orval | product |
| https://www.vulncheck.com/advisories/orval-orval-… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| orval-labs | orval |
Affected:
8.14.0 , < 8.29.0
(semver)
Unaffected: 8.29.0 (semver) cpe:2.3:a:orval:orval:*:*:*:*:*:*:*:* |
Date Public
2026-09-06 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-96755",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-23T16:47:05.260070Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T16:47:31.442Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/orval-labs/orval/security/advisories/GHSA-q7f2-jg6j-r867"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/orval",
"product": "orval",
"vendor": "orval-labs",
"versions": [
{
"lessThan": "8.29.0",
"status": "affected",
"version": "8.14.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "8.29.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:orval:orval:*:*:*:*:*:*:*:*",
"versionEndExcluding": "8.29.0",
"versionStartIncluding": "8.14.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Enrik Mustafa"
}
],
"datePublic": "2026-09-06T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "orval versions 8.14.0 through 8.28.1 contain a code injection vulnerability in the @orval/effect generator that converts OpenAPI schema defaults into template literals. Attackers can inject arbitrary JavaScript expressions via schema defaults containing ${...} syntax, which are executed at module scope when the generated code is built or imported."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T16:23:52.011Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-q7f2-jg6j-r867)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/orval-labs/orval/security/advisories/GHSA-q7f2-jg6j-r867"
},
{
"tags": [
"patch",
"issue-tracking"
],
"url": "https://github.com/orval-labs/orval/pull/3995"
},
{
"tags": [
"patch"
],
"url": "https://github.com/orval-labs/orval/commit/d346d94a660e50a2f8d0f7c17fee2c4c69d8dc23"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/orval-labs/orval/blob/v8.28.1/packages/effect/src/index.ts#L298-L302"
},
{
"tags": [
"product"
],
"url": "https://github.com/orval-labs/orval"
},
{
"name": "VulnCheck Advisory: orval @orval/effect 8.14.0 through 8.28.1 Code Injection",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/orval-orval-effect-8.14.0-through-8.28.1-code-injection"
}
],
"title": "orval @orval/effect 8.14.0 through 8.28.1 Code Injection",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-96755",
"datePublished": "2026-09-23T16:23:52.011Z",
"dateReserved": "2026-09-23T15:58:25.066Z",
"dateUpdated": "2026-09-23T16:47:31.442Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-96754 (GCVE-0-2026-96754)
Vulnerability from cvelistv5 – Published: 2026-09-23 16:23 – Updated: 2026-09-29 02:00
VLAI
EPSS
VEX
Title
orval @orval/hono before 8.29.0 Code Injection via OpenAPI Path
Summary
orval versions before 8.29.0 contain a code injection vulnerability in the @orval/hono generator that fails to escape OpenAPI path values in single-quoted route literals. Attackers can craft an OpenAPI document with an apostrophe in a static path segment to inject arbitrary JavaScript code that executes when the generated TypeScript module is imported.
Severity
9.8 (Critical)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-29 01:59 UTC
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/orval-labs/orval/security/advi… | vendor-advisory |
| https://github.com/orval-labs/orval/pull/4006 | patchissue-tracking |
| https://github.com/orval-labs/orval/commit/155a5b… | patch |
| https://github.com/orval-labs/orval/commit/d346d9… | patch |
| https://github.com/orval-labs/orval/blob/v8.28.1/… | technical-description |
| https://github.com/orval-labs/orval | product |
| https://www.vulncheck.com/advisories/orval-orval-… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| orval-labs | orval |
Affected:
0 , < 8.29.0
(semver)
Unaffected: 8.29.0 (semver) cpe:2.3:a:orval:orval:*:*:*:*:*:*:*:* |
Date Public
2026-09-06 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-96754",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-29T01:59:42.551291Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-29T02:00:26.855Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/orval-labs/orval/security/advisories/GHSA-g4mf-q5hw-f9j9"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/orval",
"product": "orval",
"vendor": "orval-labs",
"versions": [
{
"lessThan": "8.29.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "8.29.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:orval:orval:*:*:*:*:*:*:*:*",
"versionEndExcluding": "8.29.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Enrik Mustafa"
}
],
"datePublic": "2026-09-06T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "orval versions before 8.29.0 contain a code injection vulnerability in the @orval/hono generator that fails to escape OpenAPI path values in single-quoted route literals. Attackers can craft an OpenAPI document with an apostrophe in a static path segment to inject arbitrary JavaScript code that executes when the generated TypeScript module is imported."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T16:23:51.012Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-g4mf-q5hw-f9j9)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/orval-labs/orval/security/advisories/GHSA-g4mf-q5hw-f9j9"
},
{
"tags": [
"patch",
"issue-tracking"
],
"url": "https://github.com/orval-labs/orval/pull/4006"
},
{
"tags": [
"patch"
],
"url": "https://github.com/orval-labs/orval/commit/155a5b7a38ff6886020cbc4c292db57c2793e6b6"
},
{
"tags": [
"patch"
],
"url": "https://github.com/orval-labs/orval/commit/d346d94a660e50a2f8d0f7c17fee2c4c69d8dc23"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/orval-labs/orval/blob/v8.28.1/packages/hono/src/index.ts#L169-L175"
},
{
"tags": [
"product"
],
"url": "https://github.com/orval-labs/orval"
},
{
"name": "VulnCheck Advisory: orval @orval/hono before 8.29.0 Code Injection via OpenAPI Path",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/orval-orval-hono-before-8.29.0-code-injection-via-openapi-path"
}
],
"title": "orval @orval/hono before 8.29.0 Code Injection via OpenAPI Path",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-96754",
"datePublished": "2026-09-23T16:23:51.012Z",
"dateReserved": "2026-09-23T15:58:24.561Z",
"dateUpdated": "2026-09-29T02:00:26.855Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-62680 (GCVE-0-2026-62680)
Vulnerability from cvelistv5 – Published: 2026-08-19 17:42 – Updated: 2026-08-19 18:06
VLAI
EPSS
VEX
Title
Orval: Generation-time SSRF + remote/local file inclusion via unrestricted $ref
Summary
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.22.0, Orval resolves remote and local external $ref values without an allowlist or confinement to the input directory. Processing an attacker-controlled OpenAPI description can cause requests from the developer or CI host to attacker-selected or internal HTTP services, read absolute or out-of-tree local files, and inline untrusted remote schemas into generated clients. The affected code is packages/orval/src/import-specs.ts external reference loading. This issue is fixed in version 8.22.0.
Severity
7.1 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-19 18:06 UTC
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/orval-labs/orval/security/advi… | x_refsource_CONFIRM |
| https://github.com/orval-labs/orval/pull/3723 | x_refsource_MISC |
| https://github.com/orval-labs/orval/commit/23786c… | x_refsource_MISC |
| https://github.com/orval-labs/orval/releases/tag/… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| orval-labs | orval |
Affected:
< 8.22.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-62680",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-19T18:06:42.406731Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T18:06:47.948Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/orval-labs/orval/security/advisories/GHSA-cxq5-97v7-87j8"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "orval",
"vendor": "orval-labs",
"versions": [
{
"status": "affected",
"version": "\u003c 8.22.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.22.0, Orval resolves remote and local external $ref values without an allowlist or confinement to the input directory. Processing an attacker-controlled OpenAPI description can cause requests from the developer or CI host to attacker-selected or internal HTTP services, read absolute or out-of-tree local files, and inline untrusted remote schemas into generated clients. The affected code is packages/orval/src/import-specs.ts external reference loading. This issue is fixed in version 8.22.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-829",
"description": "CWE-829: Inclusion of Functionality from Untrusted Control Sphere",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918: Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T17:42:11.227Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/orval-labs/orval/security/advisories/GHSA-cxq5-97v7-87j8",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/orval-labs/orval/security/advisories/GHSA-cxq5-97v7-87j8"
},
{
"name": "https://github.com/orval-labs/orval/pull/3723",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/orval-labs/orval/pull/3723"
},
{
"name": "https://github.com/orval-labs/orval/commit/23786c056f4eba38c02bf2968677988dbbe4de10",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/orval-labs/orval/commit/23786c056f4eba38c02bf2968677988dbbe4de10"
},
{
"name": "https://github.com/orval-labs/orval/releases/tag/v8.22.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/orval-labs/orval/releases/tag/v8.22.0"
}
],
"source": {
"advisory": "GHSA-cxq5-97v7-87j8",
"discovery": "UNKNOWN"
},
"title": "Orval: Generation-time SSRF + remote/local file inclusion via unrestricted $ref"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-62680",
"datePublished": "2026-08-19T17:42:11.227Z",
"dateReserved": "2026-07-14T20:22:04.395Z",
"dateUpdated": "2026-08-19T18:06:47.948Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-62682 (GCVE-0-2026-62682)
Vulnerability from cvelistv5 – Published: 2026-08-19 17:40 – Updated: 2026-08-19 18:19
VLAI
EPSS
VEX
Title
Orval: RCE via servers[].url -> unescaped request-URL template literal (with getBaseUrlFromSpecification)
Summary
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, an unescaped backtick in servers[0].url is emitted into request URL template literals generated when output.baseUrl.getBaseUrlFromSpecification is enabled without safe encoding. This permits attacker-controlled JavaScript to be evaluated when a generated request or URL-builder function is called, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/core/src/getters/route.ts function getFullRoute. This issue is fixed in version 8.21.0.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-19 18:18 UTC
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/orval-labs/orval/security/advi… | x_refsource_CONFIRM |
| https://github.com/orval-labs/orval/pull/3692 | x_refsource_MISC |
| https://github.com/orval-labs/orval/commit/8ef1bf… | x_refsource_MISC |
| https://github.com/orval-labs/orval/releases/tag/… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| orval-labs | orval |
Affected:
< 8.21.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-62682",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-19T18:18:29.754822Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T18:19:27.462Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/orval-labs/orval/security/advisories/GHSA-88f2-fpv8-89q2"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "orval",
"vendor": "orval-labs",
"versions": [
{
"status": "affected",
"version": "\u003c 8.21.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, an unescaped backtick in servers[0].url is emitted into request URL template literals generated when output.baseUrl.getBaseUrlFromSpecification is enabled without safe encoding. This permits attacker-controlled JavaScript to be evaluated when a generated request or URL-builder function is called, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/core/src/getters/route.ts function getFullRoute. This issue is fixed in version 8.21.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-116",
"description": "CWE-116: Improper Encoding or Escaping of Output",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-1336",
"description": "CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T17:40:17.061Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/orval-labs/orval/security/advisories/GHSA-88f2-fpv8-89q2",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/orval-labs/orval/security/advisories/GHSA-88f2-fpv8-89q2"
},
{
"name": "https://github.com/orval-labs/orval/pull/3692",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/orval-labs/orval/pull/3692"
},
{
"name": "https://github.com/orval-labs/orval/commit/8ef1bfdf3f9bcaf9dabfbe2e42887f1c0e159ab6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/orval-labs/orval/commit/8ef1bfdf3f9bcaf9dabfbe2e42887f1c0e159ab6"
},
{
"name": "https://github.com/orval-labs/orval/releases/tag/v8.21.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/orval-labs/orval/releases/tag/v8.21.0"
}
],
"source": {
"advisory": "GHSA-88f2-fpv8-89q2",
"discovery": "UNKNOWN"
},
"title": "Orval: RCE via servers[].url -\u003e unescaped request-URL template literal (with getBaseUrlFromSpecification)"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-62682",
"datePublished": "2026-08-19T17:40:17.061Z",
"dateReserved": "2026-07-14T20:22:04.395Z",
"dateUpdated": "2026-08-19T18:19:27.462Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-72717 (GCVE-0-2026-72717)
Vulnerability from cvelistv5 – Published: 2026-08-19 17:39 – Updated: 2026-08-21 19:44
VLAI
EPSS
VEX
Title
Orval: Import-time RCE via schema default -> zod module-level template literal
Summary
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a ${...} expression or backtick in a schema default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permits attacker-controlled JavaScript to be evaluated when the generated zod schema module is imported, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/zod/src/index.ts function formatDefaultValue. This issue is fixed in version 8.21.0.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-21 19:44 UTC
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/orval-labs/orval/security/advi… | x_refsource_CONFIRM |
| https://github.com/orval-labs/orval/pull/3692 | x_refsource_MISC |
| https://github.com/orval-labs/orval/commit/8ef1bf… | x_refsource_MISC |
| https://github.com/orval-labs/orval/releases/tag/… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| orval-labs | orval |
Affected:
< 8.21.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-72717",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-21T19:44:08.757181Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-21T19:44:34.681Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/orval-labs/orval/security/advisories/GHSA-w727-8j6c-2rj4"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "orval",
"vendor": "orval-labs",
"versions": [
{
"status": "affected",
"version": "\u003c 8.21.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a ${...} expression or backtick in a schema default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permits attacker-controlled JavaScript to be evaluated when the generated zod schema module is imported, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/zod/src/index.ts function formatDefaultValue. This issue is fixed in version 8.21.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-116",
"description": "CWE-116: Improper Encoding or Escaping of Output",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-1336",
"description": "CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T17:39:23.125Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/orval-labs/orval/security/advisories/GHSA-w727-8j6c-2rj4",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/orval-labs/orval/security/advisories/GHSA-w727-8j6c-2rj4"
},
{
"name": "https://github.com/orval-labs/orval/pull/3692",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/orval-labs/orval/pull/3692"
},
{
"name": "https://github.com/orval-labs/orval/commit/8ef1bfdf3f9bcaf9dabfbe2e42887f1c0e159ab6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/orval-labs/orval/commit/8ef1bfdf3f9bcaf9dabfbe2e42887f1c0e159ab6"
},
{
"name": "https://github.com/orval-labs/orval/releases/tag/v8.21.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/orval-labs/orval/releases/tag/v8.21.0"
}
],
"source": {
"advisory": "GHSA-w727-8j6c-2rj4",
"discovery": "UNKNOWN"
},
"title": "Orval: Import-time RCE via schema default -\u003e zod module-level template literal"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-72717",
"datePublished": "2026-08-19T17:39:23.125Z",
"dateReserved": "2026-08-10T13:48:09.545Z",
"dateUpdated": "2026-08-21T19:44:34.681Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-71867 (GCVE-0-2026-71867)
Vulnerability from cvelistv5 – Published: 2026-08-19 17:38 – Updated: 2026-08-19 18:21
VLAI
EPSS
VEX
Title
Orval: RCE via schema property name -> computed-property-key injection in the MSW mock generator
Summary
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a single quote in a schema property name is emitted into single-quoted object keys in generated MSW mock factories without safe encoding. This permits attacker-controlled JavaScript to be evaluated when the generated mock factory is called by tests or an MSW handler, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/core/src/getters/keys.ts function getKey and MSW mock generation. This issue is fixed in version 8.21.0.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-19 18:21 UTC
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/orval-labs/orval/security/advi… | x_refsource_CONFIRM |
| https://github.com/orval-labs/orval/pull/3692 | x_refsource_MISC |
| https://github.com/orval-labs/orval/commit/8ef1bf… | x_refsource_MISC |
| https://github.com/orval-labs/orval/releases/tag/… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| orval-labs | orval |
Affected:
< 8.21.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-71867",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-19T18:21:14.097525Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T18:21:51.339Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/orval-labs/orval/security/advisories/GHSA-2w86-xfrc-g85r"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "orval",
"vendor": "orval-labs",
"versions": [
{
"status": "affected",
"version": "\u003c 8.21.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a single quote in a schema property name is emitted into single-quoted object keys in generated MSW mock factories without safe encoding. This permits attacker-controlled JavaScript to be evaluated when the generated mock factory is called by tests or an MSW handler, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/core/src/getters/keys.ts function getKey and MSW mock generation. This issue is fixed in version 8.21.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-95",
"description": "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (\u0027Eval Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T17:38:36.371Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/orval-labs/orval/security/advisories/GHSA-2w86-xfrc-g85r",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/orval-labs/orval/security/advisories/GHSA-2w86-xfrc-g85r"
},
{
"name": "https://github.com/orval-labs/orval/pull/3692",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/orval-labs/orval/pull/3692"
},
{
"name": "https://github.com/orval-labs/orval/commit/8ef1bfdf3f9bcaf9dabfbe2e42887f1c0e159ab6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/orval-labs/orval/commit/8ef1bfdf3f9bcaf9dabfbe2e42887f1c0e159ab6"
},
{
"name": "https://github.com/orval-labs/orval/releases/tag/v8.21.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/orval-labs/orval/releases/tag/v8.21.0"
}
],
"source": {
"advisory": "GHSA-2w86-xfrc-g85r",
"discovery": "UNKNOWN"
},
"title": "Orval: RCE via schema property name -\u003e computed-property-key injection in the MSW mock generator"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-71867",
"datePublished": "2026-08-19T17:38:36.371Z",
"dateReserved": "2026-08-07T18:26:53.524Z",
"dateUpdated": "2026-08-19T18:21:51.339Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-71868 (GCVE-0-2026-71868)
Vulnerability from cvelistv5 – Published: 2026-08-19 17:37 – Updated: 2026-08-21 19:43
VLAI
EPSS
VEX
Title
Orval: Import-time RCE via enum-typed default -> zod module-level template literal
Summary
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a ${...} expression or backtick in an enum default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permits attacker-controlled JavaScript to be evaluated when the generated zod schema module is imported, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/zod/src/index.ts function formatDefaultValue. This issue is fixed in version 8.21.0.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-21 19:43 UTC
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/orval-labs/orval/security/advi… | x_refsource_CONFIRM |
| https://github.com/orval-labs/orval/pull/3692 | x_refsource_MISC |
| https://github.com/orval-labs/orval/commit/8ef1bf… | x_refsource_MISC |
| https://github.com/orval-labs/orval/releases/tag/… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| orval-labs | orval |
Affected:
< 8.21.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-71868",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-21T19:43:10.477229Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-21T19:43:39.471Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/orval-labs/orval/security/advisories/GHSA-3575-w9fc-c2j6"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "orval",
"vendor": "orval-labs",
"versions": [
{
"status": "affected",
"version": "\u003c 8.21.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a ${...} expression or backtick in an enum default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permits attacker-controlled JavaScript to be evaluated when the generated zod schema module is imported, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/zod/src/index.ts function formatDefaultValue. This issue is fixed in version 8.21.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-1336",
"description": "CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T17:37:34.092Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/orval-labs/orval/security/advisories/GHSA-3575-w9fc-c2j6",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/orval-labs/orval/security/advisories/GHSA-3575-w9fc-c2j6"
},
{
"name": "https://github.com/orval-labs/orval/pull/3692",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/orval-labs/orval/pull/3692"
},
{
"name": "https://github.com/orval-labs/orval/commit/8ef1bfdf3f9bcaf9dabfbe2e42887f1c0e159ab6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/orval-labs/orval/commit/8ef1bfdf3f9bcaf9dabfbe2e42887f1c0e159ab6"
},
{
"name": "https://github.com/orval-labs/orval/releases/tag/v8.21.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/orval-labs/orval/releases/tag/v8.21.0"
}
],
"source": {
"advisory": "GHSA-3575-w9fc-c2j6",
"discovery": "UNKNOWN"
},
"title": "Orval: Import-time RCE via enum-typed default -\u003e zod module-level template literal"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-71868",
"datePublished": "2026-08-19T17:37:34.092Z",
"dateReserved": "2026-08-07T18:26:53.524Z",
"dateUpdated": "2026-08-21T19:43:39.471Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-71865 (GCVE-0-2026-71865)
Vulnerability from cvelistv5 – Published: 2026-08-19 17:36 – Updated: 2026-08-21 21:49
VLAI
EPSS
VEX
Title
Orval: Import-time RCE via query parameter name -> computed-property-key injection in the zod cli
Summary
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a double quote in a query parameter name is emitted into the generated request-validation zod.object({...}) schema without safe encoding. This permits attacker-controlled JavaScript to be evaluated when the generated zod schema module is imported, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/zod/src/index.ts and query request-validation generation. This issue is fixed in version 8.21.0.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-21 21:10 UTC
CWE
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/orval-labs/orval/security/advi… | x_refsource_CONFIRM |
| https://github.com/orval-labs/orval/pull/3692 | x_refsource_MISC |
| https://github.com/orval-labs/orval/commit/8ef1bf… | x_refsource_MISC |
| https://github.com/orval-labs/orval/releases/tag/… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| orval-labs | orval |
Affected:
< 8.21.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-71865",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-21T21:10:45.408281Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-21T21:49:30.476Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "orval",
"vendor": "orval-labs",
"versions": [
{
"status": "affected",
"version": "\u003c 8.21.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a double quote in a query parameter name is emitted into the generated request-validation zod.object({...}) schema without safe encoding. This permits attacker-controlled JavaScript to be evaluated when the generated zod schema module is imported, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/zod/src/index.ts and query request-validation generation. This issue is fixed in version 8.21.0."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-95",
"description": "CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (\u0027Eval Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-116",
"description": "CWE-116: Improper Encoding or Escaping of Output",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T17:36:47.668Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/orval-labs/orval/security/advisories/GHSA-653q-5476-x79g",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/orval-labs/orval/security/advisories/GHSA-653q-5476-x79g"
},
{
"name": "https://github.com/orval-labs/orval/pull/3692",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/orval-labs/orval/pull/3692"
},
{
"name": "https://github.com/orval-labs/orval/commit/8ef1bfdf3f9bcaf9dabfbe2e42887f1c0e159ab6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/orval-labs/orval/commit/8ef1bfdf3f9bcaf9dabfbe2e42887f1c0e159ab6"
},
{
"name": "https://github.com/orval-labs/orval/releases/tag/v8.21.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/orval-labs/orval/releases/tag/v8.21.0"
}
],
"source": {
"advisory": "GHSA-653q-5476-x79g",
"discovery": "UNKNOWN"
},
"title": "Orval: Import-time RCE via query parameter name -\u003e computed-property-key injection in the zod cli"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-71865",
"datePublished": "2026-08-19T17:36:47.668Z",
"dateReserved": "2026-08-07T18:26:53.524Z",
"dateUpdated": "2026-08-21T21:49:30.476Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}