CVE-2026-96755 orval @orval/effect 8.14.0 through 8.28.1 Code Injection
Attackers can inject arbitrary JavaScript via OpenAPI schema defaults, leading to code execution when generated code is built or imported.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-96755?
CVE-2026-96755 is a critical code injection vulnerability in orval-labs orval, published on 23 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
orval versions 8.14.0 through 8.28.1 contain a code injection vulnerability in the @orval/effect generator that converts OpenAPI schema defaults into template literals. Attackers can inject arbitrary JavaScript expressions via schema defaults containing ${...} syntax, which are executed at module scope when the generated code is built or imported.
Weakness: CWE-94
Which versions are affected by CVE-2026-96755?
How do I fix CVE-2026-96755?
No fix has been published for CVE-2026-96755 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-96755 being exploited?
There is no known exploitation of CVE-2026-96755 in the wild and no public exploit code.
Sources
Also known as GHSA-q7f2-jg6j-r867, GHSA-qr45-pvfw-p22r.