@rootio/orval vulnerabilities (Root)
13 vulnerabilities.
-
@rootio/orvalRoot AIKIDO-2026-939997 in orval - Patched by Root No score -
@rootio/orvalRoot Orval: Generation-time SSRF + remote/local file inclusion via unrestricted $ref 7.1 High -
@rootio/orvalRoot Orval: RCE via servers[].url -> unescaped request-URL template literal (with getBaseUrlFromSpecification) 9.3 Critical -
@rootio/orvalRoot Orval: Import-time RCE via schema default -> zod module-level template literal 9.3 Critical -
@rootio/orvalRoot Orval: RCE via schema property name -> computed-property-key injection in the MSW mock generator 9.3 Critical -
@rootio/orvalRoot Orval: Import-time RCE via enum-typed default -> zod module-level template literal 9.3 Critical -
@rootio/orvalRoot Orval: Import-time RCE via query parameter name -> computed-property-key injection in the zod cli 9.3 Critical -
@rootio/orvalRoot Orval: Import-time RCE via array-items default -> zod module-level template literal 9.3 Critical -
@rootio/orvalRoot Orval: Import-time RCE via header parameter name -> computed-property-key injection in the zod client 9.3 Critical -
@rootio/orvalRoot Orval: Import-time RCE via header-parameter default -> zod module-level template literal 9.3 Critical -
@rootio/orvalRoot Orval: Import-time RCE via query-parameter default -> zod module-level template literal 9.3 Critical -
@rootio/orvalRoot Orval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout) 9.3 Critical -
@rootio/orvalRoot Orval: Import-time RCE via schema property name -> computed-property-key injection in the zod client 9.3 Critical