CVE-2026-96756: orval before 8.30.0 Code Injection via Factory Generation
orval versions before 8.30.0 contain a code injection vulnerability in the @orval/core factory generator that fails to escape date default values in new Date() calls. Attackers can inject arbitrary expressions through apostrophes in OpenAPI schema defaults to execute code with the privileges of the consumer process when factoryMethods and useDates options are enabled.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
orvalto a version that resolves this vulnerability.Fixed in 8.30.0
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Consumers using orval versions before 8.30.0 are exposed when both the factoryMethods and useDates options are enabled and the generator processes OpenAPI schema default values.
What does an attacker need to exploit the vulnerability?
An attacker needs to control, or cause the consumer to process, an OpenAPI schema containing a date default value with an apostrophe. The injected expression executes during generation with the privileges of the consumer process.
Are default orval configurations affected?
The issue requires both factoryMethods and useDates to be enabled. The provided information does not establish whether those options are enabled by default.
How can teams identify potentially affected generation workflows?
Review orval usage for versions before 8.30.0 and configurations enabling both factoryMethods and useDates. Also identify workflows that generate code from OpenAPI specifications supplied by external or less-trusted sources.