Orval-labs vulnerabilities

Products

• Orval 22

Newest

• orval-labs orval orval before 8.29.0 Code Injection via operationId CVE-2026-96759 9.3 CriticalSeptember 23, 2026
• orval-labs orval orval @orval/core before 8.28.0 Code Injection via Form-Data CVE-2026-96758 9.3 CriticalSeptember 23, 2026
• orval-labs orval orval before 8.29.0 Code Injection via unescaped OpenAPI media-type CVE-2026-96757 9.3 CriticalSeptember 23, 2026
• orval-labs orval orval before 8.30.0 Code Injection via Factory Generation CVE-2026-96756 9.2 CriticalSeptember 23, 2026
• orval-labs orval orval @orval/effect 8.14.0 through 8.28.1 Code Injection CVE-2026-96755 9.3 CriticalSeptember 23, 2026
• orval-labs orval orval @orval/hono before 8.29.0 Code Injection via OpenAPI Path CVE-2026-96754 9.3 CriticalSeptember 23, 2026
• orval-labs orval Orval: Generation-time SSRF + remote/local file inclusion via unrestricted $ref CVE-2026-62680 Fix available 7.1 HighAugust 19, 2026
• orval-labs orval Orval: RCE via servers[].url -> unescaped request-URL template literal (with getBaseUrlFromSpecification) CVE-2026-62682 Fix available 9.3 CriticalAugust 19, 2026
• orval-labs orval Orval: Import-time RCE via schema default -> zod module-level template literal CVE-2026-72717 Fix available 9.3 CriticalAugust 19, 2026
• orval-labs orval Orval: RCE via schema property name -> computed-property-key injection in the MSW mock generator CVE-2026-71867 Fix available 9.3 CriticalAugust 19, 2026
• orval-labs orval Orval: Import-time RCE via enum-typed default -> zod module-level template literal CVE-2026-71868 Fix available 9.3 CriticalAugust 19, 2026
• orval-labs orval Orval: Import-time RCE via query parameter name -> computed-property-key injection in the zod cli CVE-2026-71865 Fix available 9.3 CriticalAugust 19, 2026
• orval-labs orval Orval: Import-time RCE via array-items default -> zod module-level template literal CVE-2026-71869 Fix available 9.3 CriticalAugust 19, 2026
• orval-labs orval Orval: Import-time RCE via header parameter name -> computed-property-key injection in the zod client CVE-2026-71864 Fix available 9.3 CriticalAugust 19, 2026
• orval-labs orval Orval: Import-time RCE via header-parameter default -> zod module-level template literal CVE-2026-71871 Fix available 9.3 CriticalAugust 19, 2026
• orval-labs orval Orval: Import-time RCE via query-parameter default -> zod module-level template literal CVE-2026-72716 Fix available 9.3 CriticalAugust 19, 2026
• orval-labs orval Orval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout) CVE-2026-62681 Fix available 9.3 CriticalAugust 19, 2026
• orval-labs orval Orval: Import-time RCE via schema property name -> computed-property-key injection in the zod client CVE-2026-71866 Fix available 9.3 CriticalAugust 19, 2026
• orval Orval has a code injection via unsanitized x-enum-descriptions uing JS comments CVE-2026-25141 Fix available 9.3 CriticalJanuary 30, 2026
• orval Orval Mock Generation Code Injection via const CVE-2026-24132 Fix available 7.7 HighJanuary 22, 2026
• orval Orval MCP client is vulnerable to code injection via unsanitized x-enum-descriptions in enum generation CVE-2026-23947 Public exploitFix available 9.3 CriticalJanuary 20, 2026
• orval orval MCP client is vulnerable to a code injection attack. CVE-2026-22785 Public exploitFix available 9.3 CriticalJanuary 12, 2026