Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

22 records

Vendor: orval-labs Clear all filters
TI-2026-63855 CVE-2026-96759 · GHSA-vg3c-9fm6-r5pj

orval before 8.29.0 Code Injection via operationId

Priority HIGH 81

orval before 8.29.0 fails to escape the operationId parameter when emitting it into generated TanStack Query mutator options metadata objects.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00541 Published 2026-09-23 Fixed in 8.29.0 CWE-94
TI-2026-63854 CVE-2026-96758 · GHSA-f2xw-gqvf-336w

orval @orval/core before 8.28.0 Code Injection via Form-Data

Priority HIGH 81

orval @orval/core before 8.28.0 contains a code injection vulnerability in the form-data serializer that fails to escape multipart property names in generated template literals.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00779 Published 2026-09-23 Fixed in 8.28.0 CWE-94
TI-2026-63853 CVE-2026-96757 · GHSA-2hg7-crf6-4xp2

orval before 8.29.0 Code Injection via unescaped OpenAPI media-type

Priority HIGH 81

orval before 8.29.0 fails to escape OpenAPI media-type keys when emitting them into single-quoted Content-Type string literals in generated code.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00816 Published 2026-09-23 Fixed in 8.29.0 CWE-94
TI-2026-63852 CVE-2026-96756 · GHSA-j4vv-v4c9-8599

orval before 8.30.0 Code Injection via Factory Generation

Priority MEDIUM 43

orval versions before 8.30.0 contain a code injection vulnerability in the @orval/core factory generator that fails to escape date default values in new Date() calls.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00883 Published 2026-09-23 Fixed in 8.30.0 CWE-94
TI-2026-63851 CVE-2026-96755 · GHSA-qr45-pvfw-p22r

orval @orval/effect 8.14.0 through 8.28.1 Code Injection

Priority MEDIUM 49

orval versions 8.14.0 through 8.28.1 contain a code injection vulnerability in the @orval/effect generator that converts OpenAPI schema defaults into template literals.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00779 Published 2026-09-23 Fixed in 8.29.0 CWE-94
TI-2026-63850 CVE-2026-96754 · GHSA-4p56-cvjx-38fv

orval @orval/hono before 8.29.0 Code Injection via OpenAPI Path

Priority HIGH 81

orval versions before 8.29.0 contain a code injection vulnerability in the @orval/hono generator that fails to escape OpenAPI path values in single-quoted route literals.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00542 Published 2026-09-23 Fixed in 8.29.0 CWE-94
TI-2026-19450 CVE-2026-24132 · GHSA-f456-rf33-4626

Orval Mock Generation Code Injection via const

Priority LOW 37

Orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification.

CVSS 4.0HIGH 7.7 Network No auth User interaction EPSS 0.00743 Published 2026-01-22 Fixed in 7.20.0, 8.0.3 CWE-77
TI-2026-18303 CVE-2026-22785 · GHSA-mwr6-3gp8-9jmj

orval MCP client is vulnerable to a code injection attack.

Priority MEDIUM 49

orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00778 Published 2026-01-12 Fixed in 7.18.0 CWE-77