CVE-2026-96754 — orval @orval/hono before 8.29.0 Code Injection via OpenAPI Path
orval versions before 8.29.0 contain a code injection vulnerability in the @orval/hono generator that fails to escape OpenAPI path values in single-quoted route literals. Attack…
Published: 2026-09-23 · CVSS: 9.3 · CVSS 4.0
orval versions before 8.29.0 contain a code injection vulnerability in the @orval/hono generator that fails to escape OpenAPI path values in single-quoted route literals. Attackers can craft an OpenAPI document with an apostrophe in a static path segment to inject arbitrary JavaScript code that executes when the generated TypeScript module is imported.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7