Vulnerability details

CVE-2026-96756

orval-labs orval

orval before 8.30.0 Code Injection via Factory Generation

CVSS 4.0

9.2Critical

Official description

orval versions before 8.30.0 contain a code injection vulnerability in the @orval/core factory generator that fails to escape date default values in new Date() calls. Attackers can inject arbitrary expressions through apostrophes in OpenAPI schema defaults to execute code with the privileges of the consumer process when factoryMethods and useDates options are enabled.

CVSS scores

Score	Version	Source	Vector
9.2Critical	4.0	CVEProject cvelistV5 (CNA) (VulnCheck)	`CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`
8.1High	3.1	CVEProject cvelistV5 (CNA) (VulnCheck)	`CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H`

Affected products

Vendor	Product	Versions	Source
orval-labs	orval	v < 8.30.0	CVEProject cvelistV5 (CNA)

References and advisories

https://github.com/orval-labs/orval/security/advisories/GHSA-wx66-36r6-v5g7 vendor-advisory
https://github.com/orval-labs/orval/pull/4038 patchissue-tracking
https://github.com/orval-labs/orval/commit/b9b083576943c683540200eb957feced57dddc1a patch
https://github.com/orval-labs/orval/blob/v8.29.0/packages/core/src/generators/factory.ts#L493 technical-description
https://github.com/orval-labs/orval product
https://www.vulncheck.com/advisories/orval-before-8.30.0-code-injection-via-factory-generation third-party-advisory

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-09-23
Last updated: 2026-09-23
State: Published
Assigner (CNA): VulnCheck

Exploit prediction (EPSS)

0.88%

Probability of exploitation in 30 days

59.3%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: None
Technical impact: Total

Weaknesses (CWE)

CWE-94
Improper Control of Generation of Code ('Code Injection')