Code Injection Vulnerability in orval/core by orval

CVE-2026-96758

What is CVE-2026-96758?

The orval/core library prior to version 8.28.0 contains a code injection vulnerability that arises from improper escaping of multipart property names in generated template literals. This flaw allows attackers to inject malicious ${...} expressions into OpenAPI schema property names. When a client builds FormData bodies, these expressions can be executed with consumer process privileges, which poses significant security risks. It's crucial for users of affected versions to update to the latest version to mitigate this vulnerability.

References