CVE-2026-96759
Received Received - Intake

orval TanStack Query OperationId JavaScript Injection Vulnerability

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: VulnCheck

Description
orval before 8.29.0 fails to escape the operationId parameter when emitting it into generated TanStack Query mutator options metadata objects. Attackers can inject arbitrary JavaScript code through a crafted operationId in an OpenAPI specification that executes when generated hooks are called.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-23
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-96759
EUVD
EUVD-2026-85409

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a code injection flaw in the orval library versions before 8.29.0. It occurs when the operationId parameter in an OpenAPI specification is not properly escaped during code generation. Attackers can inject malicious JavaScript code by crafting a specific operationId, which executes when the generated TanStack Query hooks are called.

Detection Guidance

To detect this vulnerability, inspect your Orval-generated TanStack Query code for improperly escaped operationId values in mutator options. Check if operationId values are directly embedded without escaping in generated files. Review OpenAPI specifications for untrusted operationId fields that may contain JavaScript code or special characters.

Impact Analysis

If exploited, this vulnerability allows attackers to execute arbitrary JavaScript code in the context where the generated hooks run. This could lead to data theft, unauthorized actions, or compromise of the application's integrity. The impact is severe due to the high CVSS scores (9.3 and 9.8) and the potential for remote code execution.

Compliance Impact

This vulnerability could lead to violations of GDPR and HIPAA by enabling unauthorized access to sensitive data or execution of malicious code. GDPR requires protection of personal data, while HIPAA mandates safeguards for health information. Exploitation could result in data breaches, triggering legal and financial penalties.

Mitigation Strategies

Upgrade Orval to version 8.29.0 or later to apply the fix. Review and sanitize any OpenAPI specifications used with Orval, ensuring operationId values are trusted and free of malicious code. Replace any direct string interpolation of operationId with proper escaping mechanisms like jsStringLiteralEscape.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-96759. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart