CVE-2026-96758 — orval @orval/core before 8.28.0 Code Injection via Form-Data
orval @orval/core before 8.28.0 contains a code injection vulnerability in the form-data serializer that fails to escape multipart property names in generated template literals.…
Published: 2026-09-23 · CVSS: 9.3 · CVSS 4.0
orval @orval/core before 8.28.0 contains a code injection vulnerability in the form-data serializer that fails to escape multipart property names in generated template literals. Attackers can inject ${...} expressions into OpenAPI schema property names that execute as live interpolation when the generated client builds FormData bodies with consumer process privileges.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7