CVE-2026-96754: orval @orval/hono before 8.29.0 Code Injection via OpenAPI Path
orval versions before 8.29.0 contain a code injection vulnerability in the @orval/hono generator that fails to escape OpenAPI path values in single-quoted route literals. Attackers can craft an OpenAPI document with an apostrophe in a static path segment to inject arbitrary JavaScript code that executes when the generated TypeScript module is imported.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
orval/@orval/honoto a version that resolves this vulnerability.Fixed in 8.29.0
Event History
Frequently Asked Questions
Which environments are exposed?
Projects using the @orval/hono generator in orval versions before 8.29.0 are affected when they generate code from an OpenAPI document containing a crafted static path segment.
What must an attacker control for exploitation?
An attacker must be able to supply or influence an OpenAPI document processed by the vulnerable generator. The document needs an apostrophe in a static path segment, and the generated TypeScript module must later be imported for the injected JavaScript to execute.
How can I determine whether generated code may be affected?
Check whether @orval/hono was used with an orval version before 8.29.0 and review the OpenAPI inputs used to generate affected modules. Pay particular attention to static path segments containing apostrophes and to generated modules that have been imported.
What is the available remediation?
Upgrade orval to version 8.29.0 or later. Regenerate affected TypeScript modules from trusted OpenAPI documents after upgrading.