CVE-2026-96759: orval before 8.29.0 Code Injection via operationId
orval before 8.29.0 fails to escape the operationId parameter when emitting it into generated TanStack Query mutator options metadata objects. Attackers can inject arbitrary JavaScript code through a crafted operationId in an OpenAPI specification that executes when generated hooks are called.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Projects using orval versions before 8.29.0 are exposed when they generate TanStack Query hooks from an OpenAPI specification containing an attacker-controlled or otherwise untrusted operationId.
What must an attacker control for exploitation?
The attacker needs to provide or modify an OpenAPI specification so that it contains a crafted operationId. The injected JavaScript executes when the generated hooks are called.
Are applications affected merely by installing a vulnerable version?
The described execution path requires generated TanStack Query hooks and a crafted operationId in the OpenAPI input. The data does not indicate that installation alone triggers code execution.
What is the available remediation?
Upgrade orval to version 8.29.0 or later. Until upgrading, do not generate code from untrusted OpenAPI specifications and review operationId values in specifications used for generation.