by Kastro
Paper/Archive/CVE-2026-96756

CVE-2026-96756

orval-labs orval — orval before 8.30.0 Code Injection via Factory Generation

EPSS 0.9%CVSS 9.2
critical.is priorityof 100
39
CVSS 9.2 (CNA)9.2 / 10 × 3027.6Not in CISA KEV+300.0EPSS percentile 59.2.592 × 2011.8No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

orval versions before 8.30.0 contain a code injection vulnerability in the @orval/core factory generator that fails to escape date default values in new Date() calls. Attackers can inject arbitrary expressions through apostrophes in OpenAPI schema defaults to execute code with the privileges of the consumer process when factoryMethods and useDates options are enabled.

Affected

ProductAffectedFixed inSource
orval< 8.30.08.30.0CNA

Scores by source

VulnCheck (CNA)9.2CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
VulnCheck (CNA)8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

advisorygithub.com/orval-labs/orval/security/advisories/GHSA-wx66-36r6-v5g7patchgithub.com/orval-labs/orval/pull/4038patchgithub.com/orval-labs/orval/commit/b9b083576943c683540200eb957feced57dddc1awriteupgithub.com/orval-labs/orval/blob/v8.29.0/packages/core/src/generators/factory.ts#L493refgithub.com/orval-labs/orvalwriteupvulncheck.com/advisories/orval-before-8.30.0-code-injection-via-factory-generation