What is CVE-2026-22785?

CVE-2026-22785 is a critical-severity vulnerability in Orval, classified under Command Injection. CVSS score: 9.8/10. Published 2026-01-12.

How severe is CVE-2026-22785?

Critical severity. CVSS v3 base score is 9.8 out of 10.

RCE in Orval

CVE-2026-22785

orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification. Prior to 7.18.0, the MCP server generation logic relies on string manipulation that incorporates the summary field from the OpenAPI sp…

Vulnerability class: Command Injection (OS Command Injection)

EPSS: 0.007 (48.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Orval
Orval-labs Orval — versions < 7.18.0

Weakness classification (CWE)

CWE-77 — Command Injection

References

security-advisories@github.com (x_refsource_CONFIRM, Exploit, Vendor Advisory)
security-advisories@github.com (Patch, x_refsource_MISC)

Frequently asked questions

What is CVE-2026-22785?: CVE-2026-22785 is a critical-severity vulnerability in Orval, classified under Command Injection. CVSS score: 9.8/10. Published 2026-01-12.
How severe is CVE-2026-22785?: Critical severity. CVSS v3 base score is 9.8 out of 10.