by Kastro
Paper/Archive/CVE-2026-96759

CVE-2026-96759

orval-labs orval — orval before 8.29.0 Code Injection via operationId

EPSS 0.5%public exploitCVSS 9.8
critical.is priorityof 100
49
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 45.5.455 × 209.1Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

orval before 8.29.0 fails to escape the operationId parameter when emitting it into generated TanStack Query mutator options metadata objects. Attackers can inject arbitrary JavaScript code through a crafted operationId in an OpenAPI specification that executes when generated hooks are called.

Affected

ProductAffectedFixed inSource
orval< 8.29.08.29.0CNA

Scores by source

VulnCheck (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
VulnCheck (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitgithub.com/orval-labs/orval/security/advisories/GHSA-vv88-cm6j-665jpatchgithub.com/orval-labs/orval/pull/4008patchgithub.com/orval-labs/orval/commit/b28c53f3e0c06190e0f6ea136737e6316432448fwriteupgithub.com/orval-labs/orval/blob/v8.28.1/packages/query/src/query-generator.ts#L784refgithub.com/orval-labs/orvalwriteupvulncheck.com/advisories/orval-before-8.29.0-code-injection-via-operationid