Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.3

orval may run malicious code from crafted API specs

CVE-2026-96759 · published 3 days ago
Summary

Versions of orval earlier than 8.29.0 do not clean the label (operationId) that comes from an OpenAPI description. If someone provides a specially crafted API spec, their JavaScript can be inserted and will run when the generated code is used. Upgrade to version 8.29.0 or later, or only use trusted API specifications, to eliminate the risk.

What to do
  • Update orval-labs orval to version 8.29.0 or later.
Affected software
VendorProductAffected versions
orval-labs orval < 8.29.0
Original advisory text
orval before 8.29.0 Code Injection via operationId
orval before 8.29.0 fails to escape the operationId parameter when emitting it into generated TanStack Query mutator options metadata objects. Attackers can inject arbitrary JavaScript code through a crafted operationId in an OpenAPI specification that executes when generated hooks are called.
References
Severity
9.3 Critical
CVSS 3.1: 9.8 (NVD)
CVSS 4.0: 9.3 (NVD)
Exploitation
EPSS <1%
Type
CWE-94Code Injection
Timeline
Published23 Sep 2026
Updated27 Sep 2026
First seen23 Sep 2026
Sources
CVE-2026-96759 · NVD
CVE-2026-96759 · MITRE
Track software like this
Free during beta