CVE-2026-96758: orval @orval/core before 8.28.0 Code Injection via Form-Data
orval @orval/core before 8.28.0 contains a code injection vulnerability in the form-data serializer that fails to escape multipart property names in generated template literals. Attackers can inject ${...} expressions into OpenAPI schema property names that execute as live interpolation when the generated client builds FormData bodies with consumer process privileges.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of @orval/core versions before 8.28.0 are exposed when they generate a client from an OpenAPI schema containing attacker-controlled multipart/form-data property names and the generated client builds FormData request bodies.
What does an attacker need to exploit it?
An attacker needs the ability to place a ${...} expression in an OpenAPI schema property name used by the form-data serializer. No authentication or user interaction is indicated by the supplied severity vector.
What can be done if an upgrade is not immediately possible?
Do not generate or use clients from untrusted OpenAPI schemas, particularly schemas with multipart/form-data properties. Review schema property names and generated client code for ${...} expressions before executing code that builds FormData bodies.