Skip to contentOrval-labs Orval vulnerabilities
- orval-labs orvalorval before 8.29.0 Code Injection via operationIdCVE-2026-967599.3 Critical
- orval-labs orvalorval @orval/core before 8.28.0 Code Injection via Form-DataCVE-2026-967589.3 Critical
- orval-labs orvalorval before 8.29.0 Code Injection via unescaped OpenAPI media-typeCVE-2026-967579.3 Critical
- orval-labs orvalorval before 8.30.0 Code Injection via Factory GenerationCVE-2026-967569.2 Critical
- orval-labs orvalorval @orval/effect 8.14.0 through 8.28.1 Code InjectionCVE-2026-967559.3 Critical
- orval-labs orvalorval @orval/hono before 8.29.0 Code Injection via OpenAPI PathCVE-2026-967549.3 Critical
- orval-labs orvalOrval: Generation-time SSRF + remote/local file inclusion via unrestricted $refCVE-2026-62680Fix available7.1 High
- orval-labs orvalOrval: RCE via servers[].url -> unescaped request-URL template literal (with getBaseUrlFromSpecification)CVE-2026-62682Fix available9.3 Critical
- orval-labs orvalOrval: Import-time RCE via schema default -> zod module-level template literalCVE-2026-72717Fix available9.3 Critical
- orval-labs orvalOrval: RCE via schema property name -> computed-property-key injection in the MSW mock generatorCVE-2026-71867Fix available9.3 Critical
- orval-labs orvalOrval: Import-time RCE via enum-typed default -> zod module-level template literalCVE-2026-71868Fix available9.3 Critical
- orval-labs orvalOrval: Import-time RCE via query parameter name -> computed-property-key injection in the zod cliCVE-2026-71865Fix available9.3 Critical
- orval-labs orvalOrval: Import-time RCE via array-items default -> zod module-level template literalCVE-2026-71869Fix available9.3 Critical
- orval-labs orvalOrval: Import-time RCE via header parameter name -> computed-property-key injection in the zod clientCVE-2026-71864Fix available9.3 Critical
- orval-labs orvalOrval: Import-time RCE via header-parameter default -> zod module-level template literalCVE-2026-71871Fix available9.3 Critical
- orval-labs orvalOrval: Import-time RCE via query-parameter default -> zod module-level template literalCVE-2026-72716Fix available9.3 Critical
- orval-labs orvalOrval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout)CVE-2026-62681Fix available9.3 Critical
- orval-labs orvalOrval: Import-time RCE via schema property name -> computed-property-key injection in the zod clientCVE-2026-71866Fix available9.3 Critical
- orvalOrval has a code injection via unsanitized x-enum-descriptions uing JS commentsCVE-2026-25141Fix available9.3 Critical
- orvalOrval Mock Generation Code Injection via constCVE-2026-24132Fix available7.7 High
- orvalOrval MCP client is vulnerable to code injection via unsanitized x-enum-descriptions in enum generationCVE-2026-23947Public exploitFix available9.3 Critical
- orvalorval MCP client is vulnerable to a code injection attack.CVE-2026-22785Public exploitFix available9.3 Critical