orval vulnerabilities (npm)
12 vulnerabilities.
-
orvalnpm Orval: Generation-time SSRF + remote/local file inclusion via unrestricted $ref 7.1 High -
orvalnpm Orval: RCE via servers[].url -> unescaped request-URL template literal (with getBaseUrlFromSpecification) 9.3 Critical -
orvalnpm Orval: Import-time RCE via schema default -> zod module-level template literal 9.3 Critical -
orvalnpm Orval: RCE via schema property name -> computed-property-key injection in the MSW mock generator 9.3 Critical -
orvalnpm Orval: Import-time RCE via enum-typed default -> zod module-level template literal 9.3 Critical -
orvalnpm Orval: Import-time RCE via query parameter name -> computed-property-key injection in the zod cli 9.3 Critical -
orvalnpm Orval: Import-time RCE via array-items default -> zod module-level template literal 9.3 Critical -
orvalnpm Orval: Import-time RCE via header parameter name -> computed-property-key injection in the zod client 9.3 Critical -
orvalnpm Orval: Import-time RCE via header-parameter default -> zod module-level template literal 9.3 Critical -
orvalnpm Orval: Import-time RCE via query-parameter default -> zod module-level template literal 9.3 Critical -
orvalnpm Orval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout) 9.3 Critical -
orvalnpm Orval: Import-time RCE via schema property name -> computed-property-key injection in the zod client 9.3 Critical