CVE-2026-96757: orval before 8.29.0 Code Injection via unescaped OpenAPI media-type
orval before 8.29.0 fails to escape OpenAPI media-type keys when emitting them into single-quoted Content-Type string literals in generated code. Attackers can inject JavaScript through crafted media-type keys in OpenAPI specifications that executes when generated fetch operations or mock resolvers are invoked.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
orvalto a version that resolves this vulnerability.Fixed in 8.29.0
Event History
Frequently Asked Questions
Which deployments are realistically exposed?
Projects using npm/orval versions before 8.29.0 are exposed if they generate code from an OpenAPI specification containing attacker-controlled media-type keys and later invoke the generated fetch operations or mock resolvers.
What must an attacker control for exploitation?
The attacker needs to supply or modify an OpenAPI specification with a crafted media-type key. No authentication or user interaction is required according to the provided severity vector.
When does the injected JavaScript execute?
The injected code executes when generated fetch operations or mock resolvers are invoked. Generating the code alone is not identified as the execution trigger.
How can I determine whether a project is affected?
Check whether the project uses an orval version earlier than 8.29.0 and whether its generated code was produced from OpenAPI specifications whose media-type keys may be untrusted or modified by attackers.