CVE-2026-96759: orval before 8.29.0 Code Injection via operationId

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-23 · updated 2026-09-29
Weakness: CWE-94

Description

orval before 8.29.0 fails to escape the operationId parameter when emitting it into generated TanStack Query mutator options metadata objects. Attackers can inject arbitrary JavaScript code through a crafted operationId in an OpenAPI specification that executes when generated hooks are called.

Affected products

orval-labs orval: before 8.29.0 — fixed in 8.29.0

How to fix

Upgrade to a fixed version: orval-labs orval 8.29.0. Check the vendor advisory for mitigations.

References

https://github.com/orval-labs/orval
https://github.com/orval-labs/orval/blob/v8.28.1/packages/query/src/query-generator.ts#L784
https://github.com/orval-labs/orval/commit/b28c53f3e0c06190e0f6ea136737e6316432448f
https://github.com/orval-labs/orval/pull/4008
https://github.com/orval-labs/orval/security/advisories/GHSA-vv88-cm6j-665j
https://www.vulncheck.com/advisories/orval-before-8.29.0-code-injection-via-operationid
https://github.com/orval-labs/orval/security/advisories/GHSA-vv88-cm6j-665j

Get alerted when CVE-2026-96759 or the next vulnerability affects your stack