CVE-2026-96755
Deferred Deferred - Pending Action

Code Injection in Orval @orval/effect Generator

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: VulnCheck

Description
orval versions 8.14.0 through 8.28.1 contain a code injection vulnerability in the @orval/effect generator that converts OpenAPI schema defaults into template literals. Attackers can inject arbitrary JavaScript expressions via schema defaults containing ${...} syntax, which are executed at module scope when the generated code is built or imported.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-11-08
AI Q&A
2026-09-23
EPSS Evaluated
2026-11-07
NVD
CVE-2026-96755
EUVD
EUVD-2026-85405

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
orval orval 8.29.0
orval effect From 8.14.0 (inc) to 8.28.1 (inc)
orval effect 8.29.0
orval orval From 8.14.0 (inc) to 8.28.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-96755 is a code injection vulnerability in the Orval tool, specifically in versions 8.14.0 through 8.28.1 of the @orval/effect generator. It allows attackers to inject arbitrary JavaScript expressions via OpenAPI schema defaults containing ${...} syntax. These injected expressions execute at module scope when the generated code is built or imported, enabling code execution during the build or import process.

Detection Guidance

To detect this vulnerability, inspect your Orval-generated code for improperly sanitized OpenAPI schema defaults. Look for template literals (${...}) in generated files that may execute arbitrary JavaScript. Check if your Orval version is between 8.14.0 and 8.28.1. Use commands like 'npm list @orval/effect' to verify installed versions.

Impact Analysis

This vulnerability can lead to arbitrary code execution in your development or CI environment. Attackers who control the OpenAPI specification could execute malicious JavaScript or OS commands when the generated code is imported. This could result in data breaches, system compromise, or unauthorized access to sensitive resources.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR, HIPAA, and other regulations due to potential data breaches or unauthorized access. GDPR requires protecting personal data, and HIPAA mandates safeguarding health information. Code execution risks could result in unauthorized data exposure, violating these compliance requirements.

Mitigation Strategies

Upgrade to Orval version 8.29.0 or later immediately. Remove any untrusted OpenAPI specifications from your build process. Review generated code for suspicious template literals. Avoid using unvalidated user-controlled OpenAPI documents in your workflow.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-96755. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...