Vulnerability Description
orval versions before 8.30.0 contain a code injection vulnerability in the @orval/core factory generator that fails to escape date default values in new Date() calls. Attackers can inject arbitrary expressions through apostrophes in OpenAPI schema defaults to execute code with the privileges of the consumer process when factoryMethods and useDates options are enabled.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/orval-labs/orval
- https://github.com/orval-labs/orval/blob/v8.29.0/packages/core/src/generators/fa
- https://github.com/orval-labs/orval/commit/b9b083576943c683540200eb957feced57ddd
- https://github.com/orval-labs/orval/pull/4038
- https://github.com/orval-labs/orval/security/advisories/GHSA-wx66-36r6-v5g7
- https://www.vulncheck.com/advisories/orval-before-8.30.0-code-injection-via-fact
FAQ
What is CVE-2026-96756?
CVE-2026-96756 is a vulnerability with a CVSS score of 8.1 (HIGH). orval versions before 8.30.0 contain a code injection vulnerability in the @orval/core factory generator that fails to escape date default values in new Date() calls. Attackers can inject arbitrary ex...
How severe is CVE-2026-96756?
CVE-2026-96756 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-96756?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.