orval before 8.30.0 Code Injection via Factory Generation
Priority MEDIUM 43CWE-94Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-94.
Summary
orval versions before 8.30.0 contain a code injection vulnerability in the @orval/core factory generator that fails to escape date default values in new Date() calls. Attackers can inject arbitrary expressions through apostrophes in OpenAPI schema defaults to execute code with the privileges of the consumer process when factoryMethods and useDates options are enabled.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00883 59th percentileScored 2026-11-07
Fix Fixed orval (orval-labs): 8.30.0
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| orval-labs | orval | before 8.30.0 | 8.30.0 | Patch available | CNA |
- orval Vendororval-labs Affected before 8.30.0 Fixed in 8.30.0 Patch available CNA
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:orval:orval:*:*:*:*:*:*:*:* | — | — | orval-labs |
- cpe:2.3:a:orval:orval:*:*:*:*:*:*:*:* Versions — — ·orval-labs
Remediation
- Fix · CNA orval (orval-labs) Fixed in 8.30.0
Timeline
- 2026-10-02 Threatist record created from CVE-2026-96756
- 2026-10-03 Alias added: GHSA-j4vv-v4c9-8599
- 2026-10-25 EPSS moved to the 50th–90th percentile
References
Patch 2
More orval-labs vulnerabilities
- TI-2026-63855 orval before 8.29.0 Code Injection via operationId CVSS 4.0CRITICAL 9.3
- TI-2026-63854 orval @orval/core before 8.28.0 Code Injection via Form-Data CVSS 4.0CRITICAL 9.3
- TI-2026-63853 orval before 8.29.0 Code Injection via unescaped OpenAPI media-type CVSS 4.0CRITICAL 9.3
- TI-2026-63850 orval @orval/hono before 8.29.0 Code Injection via OpenAPI Path CVSS 4.0CRITICAL 9.3
- TI-2026-50952 Orval: Import-time RCE via schema default -> zod module-level template literal CVSS 4.0CRITICAL 9.3
- TI-2026-50951 Orval: Import-time RCE via query-parameter default -> zod module-level template literal CVSS 4.0CRITICAL 9.3
Sources
- CVE-2026-96756 · CVE Program
- CVE-2026-96756 · NVD
- FIRST EPSS
- GHSA-j4vv-v4c9-8599 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences