orval-labs vulnerabilities

Newest CVEs

• CVE-2026-96759

  orval before 8.29.0 Code Injection via operationId

  orval-labs · orval

  Critical9.3
• CVE-2026-96758

  orval @orval/core before 8.28.0 Code Injection via Form-Data

  orval-labs · orval

  Critical9.3
• CVE-2026-96757

  orval before 8.29.0 Code Injection via unescaped OpenAPI media-type

  orval-labs · orval

  Critical9.3
• CVE-2026-96756

  orval before 8.30.0 Code Injection via Factory Generation

  orval-labs · orval

  Critical9.2
• CVE-2026-96755

  orval @orval/effect 8.14.0 through 8.28.1 Code Injection

  orval-labs · orval

  Critical9.3
• CVE-2026-96754

  orval @orval/hono before 8.29.0 Code Injection via OpenAPI Path

  orval-labs · orval

  Critical9.3
• CVE-2026-62680

  Orval: Generation-time SSRF + remote/local file inclusion via unrestricted $ref

  orval-labs · orval

  High7.1
• CVE-2026-62682

  Orval: RCE via servers[].url -> unescaped request-URL template literal (with getBaseUrlFromSpecification)

  orval-labs · orval

  Critical9.3
• CVE-2026-72717

  Orval: Import-time RCE via schema default -> zod module-level template literal

  orval-labs · orval

  Critical9.3
• CVE-2026-71867

  Orval: RCE via schema property name -> computed-property-key injection in the MSW mock generator

  orval-labs · orval

  Critical9.3