CVE Vulnerability Catalog

Orval (prior to 8.21.0) generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. A ${...} expression or backtick in a schema default is emitted into a module-level template literal without safe encoding, allowing attacker-controlled JavaScript to be evaluated when the generated zod schema module is imported, resulting in code execution in the developer, CI, test, or application environment.

Orval (prior to 8.21.0) generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. A ${...} expression or backtick in a query parameter default is emitted into a module-level template literal without safe encoding, allowing attacker-controlled JavaScript to be evaluated when the generated zod schema module is imported, resulting in code execution in the developer, CI, test, or application environment.

Orval (prior to 8.21.0) generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. A ${...} expression or backtick in a header parameter default is emitted into a module-level template literal without safe encoding, allowing attacker-controlled JavaScript to be evaluated when the generated zod schema module is imported, resulting in code execution in the developer, CI, test, or application environment.

Orval (prior to 8.21.0) generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. A ${...} expression or backtick in an array item default is emitted into a module-level template literal without safe encoding, allowing attacker-controlled JavaScript to be evaluated when the generated zod schema module is imported, resulting in code execution in the developer, CI, test, or application environment.

Orval before 8.21.0 unsafely encodes ${...} expressions or backticks in enum defaults in generated zod schemas, allowing malicious JavaScript execution when the module is imported.

Orval before 8.21.0 unsafely encodes single quotes in schema property names in generated MSW mock factories, allowing malicious JavaScript execution when the factory is called.

Orval from 8.19.0 to 8.21.0 unsafely encodes double quotes in schema property names in generated zod.object({...}) schemas, allowing malicious JavaScript execution when the module is imported.

Orval before 8.21.0 unsafely encodes double quotes in query parameter names in generated request-validation zod.object({...}) schemas, allowing malicious JavaScript execution when the module is imported.

Orval before 8.21.0 unsafely encodes double quotes in header parameter names in generated request-validation zod.object({...}) schemas, allowing malicious JavaScript execution when the module is imported.

This CVE ID has been rejected. It is a duplicate of CVE-2026-67306. All CVE users should reference CVE-2026-67306 instead of this candidate.

A vulnerability in ZenHive mpp allows an unauthenticated remote client to obtain paid resources by resubmitting one settled on-chain transfer. The EVM verification mechanism does not bind the proof to the challenge or prior use, and deduplication keys are regenerated on every 402 response. On a static-price route, a single historical transfer satisfies an unbounded number of later charges.

In the cluster-proxy-addon component of Multicluster Engine for Kubernetes, an unauthenticated attacker with access to the user-facing route can bypass authentication and authorization checks. By manipulating URL path segments, the attacker can proxy requests to arbitrary services across any managed cluster.

In FreeRDP before 3.28.0, rdpsnd_server_recv_formats frees context->client_formats on a malformed Client Audio Formats PDU without clearing the pointer or count. An authenticated RDP client can trigger an error, leaving a dangling pointer, leading to a double-free at session teardown. This can crash the server and cause heap corruption.

In FreeRDP before 3.28.0, freerdp_dsp_decode_opus calls Stream_EnsureRemainingCapacity on the context buffer even though opus_decode writes to the caller-supplied stream. A malicious RDP server negotiating WAVE_FORMAT_OPUS can cause large decoded frames to be written beyond the allocated buffer, leading to client heap corruption, crash, and potential code execution.

FreeRDP prior to 3.28.0 has a vulnerability where an authenticated RDP client can advertise DVI ADPCM with nBlockAlign equal to 8 and nChannels equal to 2 to make the `bs` calculation in rdpsnd_server_select_format in channels/rdpsnd/server/rdpsnd_main.c equal zero. The subsequent out_frames modulo `bs` operation raises SIGFPE and terminates the server-side rdpsnd channel process. This vulnerability fixed in 3.28.0.

Orval before 8.21.0 unsafely encodes unescaped backticks in servers[0].url in generated request URL template literals when output.baseUrl.getBaseUrlFromSpecification is enabled, allowing malicious JavaScript execution when a generated function is called.

Orval before 8.21.0 unsafely encodes unescaped backticks in OpenAPI paths in generated request URL template literals for axios, fetch, react-query, and SWR clients, allowing malicious JavaScript execution when a generated function is called.

Orval before 8.22.0 resolves external $ref values without an allowlist or confinement to the input directory. Processing an attacker-controlled OpenAPI specification can cause requests to attacker-selected HTTP services, read local files outside the project tree, and inline untrusted schemas into generated clients.

ISPConfig contains an authenticated SQL injection vulnerability in the Remote API. The primary_id parameter in delete and update methods is concatenated directly into SQL WHERE clauses without integer casting or parameterized binding. A user with any low-privilege function permission can inject arbitrary SQL, delete or modify records across all tenants, and extract data including password hashes.

FreeRDP prior to 3.27.0 has a vulnerability in freerdp_image_copy_from_icon_data in libfreerdp/codec/color.c where nWidth multiplied by nHeight multiplied by FreeRDPGetBytesPerPixel(format) is calculated in 32-bit arithmetic. A malicious RDP server can send a RAIL TS_ICON_INFO update with dimensions such as 32768 by 32768 and 32 bits per pixel so the required-size calculation wraps, bypassing the cbBitsColor source bounds check before freerdp_image_copy_no_overlap reads attacker-controlled icon data. This affects RemoteApp clients using the vulnerable library path, while xfreerdp has a caller-side mitigation. This issue is fixed in version 3.27.0.