CVE-2026-96755 — orval @orval/effect 8.14.0 through 8.28.1 Code Injection
orval versions 8.14.0 through 8.28.1 contain a code injection vulnerability in the @orval/effect generator that converts OpenAPI schema defaults into template literals. Attacker…
Published: 2026-09-23 · CVSS: 9.3 · CVSS 4.0
orval versions 8.14.0 through 8.28.1 contain a code injection vulnerability in the @orval/effect generator that converts OpenAPI schema defaults into template literals. Attackers can inject arbitrary JavaScript expressions via schema defaults containing ${...} syntax, which are executed at module scope when the generated code is built or imported.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7