TI-2026-63851 Aliases CVE-2026-96755 GHSA-qr45-pvfw-p22r

orval @orval/effect 8.14.0 through 8.28.1 Code Injection

MEDIUM 49CWE-94Published 2026-09-23 · Updated 2026-09-23

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-94.

Summary

orval versions 8.14.0 through 8.28.1 contain a code injection vulnerability in the @orval/effect generator that converts OpenAPI schema defaults into template literals. Attackers can inject arbitrary JavaScript expressions via schema defaults containing ${...} syntax, which are executed at module scope when the generated code is built or imported.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00779 56th percentileScored 2026-11-07

Fix Fixed orval (orval-labs): 8.29.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
orval-labs	orval	8.14.0 to before 8.29.0	8.29.0	Patch available	CNA

orval Vendororval-labs Affected 8.14.0 to before 8.29.0 Fixed in 8.29.0 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:orval:orval::::::::	—	—	orval-labs

cpe:2.3:a:orval:orval:*:*:*:*:*:*:*:* Versions — — ·orval-labs

Remediation

Fix · CNA orval (orval-labs) Fixed in 8.29.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-09-23
orval-labs orval 8.29.0
4 records Highest priority Priority HIGH 3 HIGH, 1 MEDIUM
Other records, highest priority first
- TI-2026-63855 orval before 8.29.0 Code Injection via operationIdPriority HIGH 81
- TI-2026-63853 orval before 8.29.0 Code Injection via unescaped OpenAPI media-typePriority HIGH 81
- TI-2026-63850 orval @orval/hono before 8.29.0 Code Injection via OpenAPI PathPriority HIGH 81
Show all 4 records →

Timeline

2026-10-02 Threatist record created from CVE-2026-96755
2026-10-03 Alias added: GHSA-qr45-pvfw-p22r
2026-10-25 EPSS moved to the 50th–90th percentile

References

Patch 2

Advisory 1

GitHub Security Advisory (GHSA-q7f2-jg6j-r867)

Other 2

TI-2026-63855 orval before 8.29.0 Code Injection via operationId CVSS 4.0CRITICAL 9.3
TI-2026-63854 orval @orval/core before 8.28.0 Code Injection via Form-Data CVSS 4.0CRITICAL 9.3
TI-2026-63853 orval before 8.29.0 Code Injection via unescaped OpenAPI media-type CVSS 4.0CRITICAL 9.3
TI-2026-63850 orval @orval/hono before 8.29.0 Code Injection via OpenAPI Path CVSS 4.0CRITICAL 9.3
TI-2026-50952 Orval: Import-time RCE via schema default -> zod module-level template literal CVSS 4.0CRITICAL 9.3
TI-2026-50951 Orval: Import-time RCE via query-parameter default -> zod module-level template literal CVSS 4.0CRITICAL 9.3

See all 21 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences