CVE-2026-96757
Received Received - Intake

OpenAPI Media-Type Key Injection in Orval

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: VulnCheck

Description
orval before 8.29.0 fails to escape OpenAPI media-type keys when emitting them into single-quoted Content-Type string literals in generated code. Attackers can inject JavaScript through crafted media-type keys in OpenAPI specifications that executes when generated fetch operations or mock resolvers are invoked.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-23
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-96757
EUVD
EUVD-2026-85407

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
orval orval to 8.29.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-96757 is a code injection vulnerability in the Orval tool, which generates API clients from OpenAPI specifications. The issue occurs when media-type keys from OpenAPI specs are embedded into generated code without proper escaping. Attackers can craft malicious media-type keys containing JavaScript code that executes when the generated fetch operations or mock resolvers are invoked.

Detection Guidance

To detect if your system is vulnerable, check the version of Orval installed. Run: npm list orval or npx orval --version. If the version is below 8.29.0, the system is vulnerable.

Impact Analysis

This vulnerability allows attackers to inject malicious JavaScript into generated API clients or mock resolvers. This could lead to unauthorized actions, data breaches, or backdoored requests with injected headers. The impact depends on how the generated code is used in applications.

Mitigation Strategies

Upgrade Orval to version 8.29.0 or later immediately. Run: npm install orval@latest or npm update orval. Review any custom OpenAPI specifications for unusual media-type keys containing quotes or special characters.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-96757. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart