Code Injection Vulnerability in orval Product by orval-labs

CVE-2026-96754

What is CVE-2026-96754?

Versions of orval prior to 8.29.0 are susceptible to a code injection vulnerability stemming from the @orval/hono generator. The vulnerability occurs due to improper escaping of OpenAPI path values within single-quoted route literals. Malicious actors can exploit this flaw by creating an OpenAPI document that incorporates an apostrophe in a static path segment, enabling the injection of arbitrary JavaScript code. This injected code can execute when the generated TypeScript module is imported, posing significant security risks.

References