CVE-2026-96755: orval @orval/effect 8.14.0 through 8.28.1 Code Injection
orval versions 8.14.0 through 8.28.1 contain a code injection vulnerability in the @orval/effect generator that converts OpenAPI schema defaults into template literals. Attackers can inject arbitrary JavaScript expressions via schema defaults containing ${...} syntax, which are executed at module scope when the generated code is built or imported.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Projects using the @orval/effect generator in orval versions 8.14.0 through 8.28.1 are exposed when they generate code from an OpenAPI schema whose defaults an attacker can influence.
What does an attacker need to exploit it?
An attacker needs to introduce an OpenAPI schema default containing ${...} syntax. The vulnerable generator converts that default into a template literal, allowing the injected JavaScript expression to execute when generated code is built or imported.
When does the injected code run?
The injected expression executes at module scope when the generated code is built or imported. Exploitation therefore does not require a user to invoke a particular generated API operation.