Orval-Labs Orval
22 CVEs affecting Orval-Labs Orval. Latest disclosed: 2026-09-23. Critical: 9, High: 2.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-96759 | Critical | 9.8 | 2026-09-23 | orval before 8.29.0 fails to escape the operationId parameter when emitting it into generated TanStack Query mutator options metadata objects. Attackers can in… |
CVE-2026-96758 | Critical | 9.8 | 2026-09-23 | orval @orval/core before 8.28.0 contains a code injection vulnerability in the form-data serializer that fails to escape multipart property names in generated… |
CVE-2026-96757 | Critical | 9.8 | 2026-09-23 | orval before 8.29.0 fails to escape OpenAPI media-type keys when emitting them into single-quoted Content-Type string literals in generated code. Attackers can… |
CVE-2026-96755 | Critical | 9.8 | 2026-09-23 | orval versions 8.14.0 through 8.28.1 contain a code injection vulnerability in the @orval/effect generator that converts OpenAPI schema defaults into template… |
CVE-2026-96754 | Critical | 9.8 | 2026-09-23 | orval versions before 8.29.0 contain a code injection vulnerability in the @orval/hono generator that fails to escape OpenAPI path values in single-quoted rout… |
CVE-2026-25141 | Critical | 9.8 | 2026-01-30 | Orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification. Versions starting with 7.19.0 and prior to 7.21.0 and… |
CVE-2026-24132 | Critical | 9.8 | 2026-01-23 | Orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification. Versions 7.19.0 and below and 8.0.0-rc.0 through 8.0… |
CVE-2026-23947 | Critical | 9.8 | 2026-01-20 | Orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification. Versions prior to 7.19.0 until 8.0.2 are vulnerable to… |
CVE-2026-22785 | Critical | 9.8 | 2026-01-12 | orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification. Prior to 7.18.0, the MCP server generation logic relie… |
CVE-2026-96756 | High | 8.1 | 2026-09-23 | orval versions before 8.30.0 contain a code injection vulnerability in the @orval/core factory generator that fails to escape date default values in new Date()… |
CVE-2026-62680 | High | 7.1 | 2026-08-19 | Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.22.0, Orval resolves remote and local exte… |
CVE-2026-72717 | | 2026-08-19 | Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a ${...} expression or backtick in a… | |
CVE-2026-72716 | | 2026-08-19 | Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a ${...} expression or backtick in a… | |
CVE-2026-71871 | | 2026-08-19 | Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a ${...} expression or backtick in a… | |
CVE-2026-71869 | | 2026-08-19 | Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a ${...} expression or backtick in a… | |
CVE-2026-71868 | | 2026-08-19 | Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a ${...} expression or backtick in a… | |
CVE-2026-71867 | | 2026-08-19 | Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a single quote in a schema property… | |
CVE-2026-71866 | | 2026-08-19 | Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. From version 8.19.0 until 8.21.0, a double quote in a… | |
CVE-2026-71865 | | 2026-08-19 | Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a double quote in a query parameter… | |
CVE-2026-71864 | | 2026-08-19 | Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a double quote in a header parameter… |