{"vulnerability": "cve-2026-71871", "sightings": [{"uuid": "2ea4ee62-ee21-4906-a410-8f8fc14deff2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71871", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mtocsleu2e2u", "content": "CVE-2026-71871\nIf you use Orval to generate client code and include a header default that contains a back\u2011tick or ${...} expression, the generated file can run malicious JavaScript when it is loaded. This could let an\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-08-22T12:50:05.558043Z"}, {"uuid": "fcadadbf-6bf3-4a7b-9a85-261c04ee4304", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71871", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mthk2jekhx2m", "content": "\ud83d\udea8 CVE-2026-71871 \u2014 CVSS 9.3 CRITICAL\n\nOrval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. P...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-71871\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-08-19T20:11:08.296678Z"}, {"uuid": "4d6f5a04-cef5-46be-a001-50276d2a0f14", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-71871", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mthyjjhdlf2e", "content": "CVE-2026-71871 - orval\nA security issue in Orval allows attackers to inject malicious JavaScript code. This can happen when generating clients from OpenAPI specifications. Update to version 8.21.0 to fix the\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#orval #orvallabs #CVE #infosec", "creation_timestamp": "2026-08-20T00:30:04.254621Z"}]}