CVE-2026-96756

orval before 8.29.0 fails to escape the operationId parameter when emitting it into generated TanStack Query mutator options metadata objects. Attackers can inject arbitrary JavaScript code through a crafted operationId in an OpenAPI specification that executes when generated hooks are called.

orval @orval/core before 8.28.0 contains a code injection vulnerability in the form-data serializer that fails to escape multipart property names in generated template literals. Attackers can inject ${...} expressions into OpenAPI schema property names that execute as live interpolation when the generated client builds FormData bodies with consumer process privileges.

orval before 8.29.0 fails to escape OpenAPI media-type keys when emitting them into single-quoted Content-Type string literals in generated code. Attackers can inject JavaScript through crafted media-type keys in OpenAPI specifications that executes when generated fetch operations or mock resolvers are invoked.

orval versions 8.14.0 through 8.28.1 contain a code injection vulnerability in the @orval/effect generator that converts OpenAPI schema defaults into template literals. Attackers can inject arbitrary JavaScript expressions via schema defaults containing ${...} syntax, which are executed at module scope when the generated code is built or imported.

orval versions before 8.29.0 contain a code injection vulnerability in the @orval/hono generator that fails to escape OpenAPI path values in single-quoted route literals. Attackers can craft an OpenAPI document with an apostrophe in a static path segment to inject arbitrary JavaScript code that executes when the generated TypeScript module is imported.

Orval (prior to 8.21.0) generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. A ${...} expression or backtick in a schema default is emitted into a module-level template literal without safe encoding, allowing attacker-controlled JavaScript to be evaluated when the generated zod schema module is imported, resulting in code execution in the developer, CI, test, or application environment.

Orval (prior to 8.21.0) generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. A ${...} expression or backtick in a query parameter default is emitted into a module-level template literal without safe encoding, allowing attacker-controlled JavaScript to be evaluated when the generated zod schema module is imported, resulting in code execution in the developer, CI, test, or application environment.

Orval (prior to 8.21.0) generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. A ${...} expression or backtick in a header parameter default is emitted into a module-level template literal without safe encoding, allowing attacker-controlled JavaScript to be evaluated when the generated zod schema module is imported, resulting in code execution in the developer, CI, test, or application environment.

Orval (prior to 8.21.0) generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. A ${...} expression or backtick in an array item default is emitted into a module-level template literal without safe encoding, allowing attacker-controlled JavaScript to be evaluated when the generated zod schema module is imported, resulting in code execution in the developer, CI, test, or application environment.

Orval before 8.21.0 unsafely encodes ${...} expressions or backticks in enum defaults in generated zod schemas, allowing malicious JavaScript execution when the module is imported.