What’s Vulnerable › Vulnerabilities

CVE-2026-96758: orval @orval/core before 8.28.0 Code Injection via Form-Data

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-23 · updated 2026-09-23
• Weakness: CWE-94

Description

orval @orval/core before 8.28.0 contains a code injection vulnerability in the form-data serializer that fails to escape multipart property names in generated template literals. Attackers can inject ${...} expressions into OpenAPI schema property names that execute as live interpolation when the generated client builds FormData bodies with consumer process privileges.

Affected products

• orval-labs orval: before 8.28.0 — fixed in 8.28.0

How to fix

Upgrade to a fixed version: orval-labs orval 8.28.0. Check the vendor advisory for mitigations.

References

• https://github.com/orval-labs/orval
• https://github.com/orval-labs/orval/blob/v8.27.0/packages/core/src/getters/res-req-types.ts#L808
• https://github.com/orval-labs/orval/commit/975a769a76151354dead879feadfa3537ff065fe
• https://github.com/orval-labs/orval/pull/3988
• https://github.com/orval-labs/orval/security/advisories/GHSA-jwhm-6748-j6pq
• https://www.vulncheck.com/advisories/orval-orval-core-before-8.28.0-code-injection-via-form-data
• https://github.com/orval-labs/orval/security/advisories/GHSA-jwhm-6748-j6pq

Get alerted when CVE-2026-96758 or the next vulnerability affects your stack