CVE-2026-96756 | BDVDB-2026-378472 Detail
orval-labsorval
Description#
orval versions before 8.30.0 contain a code injection vulnerability in the @orval/core factory generator that fails to escape date default values in new Date() calls. Attackers can inject arbitrary expressions through apostrophes in OpenAPI schema defaults to execute code with the privileges of the consumer process when factoryMethods and useDates options are enabled.
Impact#
Per CVSS v3.1: confidentiality impact high, integrity impact high, availability impact high. Attack vector: network.
Weaknesses#
- CWE-94 Improper Control of Generation of Code ('Code Injection')
References#
- https://github.com/orval-labs/orval/security/advisories/GHSA-wx66-36r6-v5g7
- https://github.com/orval-labs/orval/pull/4038
- https://github.com/orval-labs/orval/commit/b9b083576943c683540200eb957feced57dddc1a
- https://github.com/orval-labs/orval/blob/v8.29.0/packages/core/src/generators/factory.ts#L493
- https://github.com/orval-labs/orval
- https://www.vulncheck.com/advisories/orval-before-8.30.0-code-injection-via-factory-generation
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.