CVE-2026-72717

CVE-2026-72717 is a critical (CVSS 4.0: 9.3 ) import-time remote code execution vulnerability in Orval , a tool that generates type-safe TypeScript clients from OpenAPI/Swagger specifications. The root cause is in packages/zod/src/index.ts, function formatDefaultValue: a ${...} expression or back...

CVE-2026-71868

Orval (a TypeScript client generator from OpenAPI/Swagger specs) is vulnerable to import-time remote code execution prior to version 8.21.0 . The root cause is in packages/zod/src/index.ts function formatDefaultValue: a ${...} expression or backtick in an enum default value is emitted into a modu...

CVE-2026-71868 Orval: Import-time RCE via enum-typed default -> zod module-level template literal

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a $... expression or backtick in an enum default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permits...

CVE-2026-71868 Orval: Import-time RCE via enum-typed default -> zod module-level template literal

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a $... expression or backtick in an enum default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permits...

CVE-2026-71869 Orval: Import-time RCE via array-items default -> zod module-level template literal

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a $... expression or backtick in an array item default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permits...

CVE-2026-71869

Orval (a TypeScript client generator from OpenAPI/Swagger specs) is vulnerable to import-time remote code execution prior to version 8.21.0 . The root cause is in the formatDefaultValue function (packages/zod/src/index.ts): a ${...} expression or backtick in an array item default value is emitted...

CVE-2026-71869 Orval: Import-time RCE via array-items default -> zod module-level template literal

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a $... expression or backtick in an array item default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permits...

CVE-2026-71871 Orval: Import-time RCE via header-parameter default -> zod module-level template literal

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a $... expression or backtick in a header parameter default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permi...

CVE-2026-71871

Orval (pre-8.21.0) emits unescaped ${...} or backtick strings from OpenAPI header-parameter defaults into a module-level template literal in generated zod schema code (packages/zod/src/index.ts function formatDefaultValue). Importing the generated module evaluates the attacker-controlled JavaScri...

CVE-2026-71871 Orval: Import-time RCE via header-parameter default -> zod module-level template literal

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a $... expression or backtick in a header parameter default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permi...

CVE-2026-72716 Orval: Import-time RCE via query-parameter default -> zod module-level template literal

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a $... expression or backtick in a query parameter default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permit...

CVE-2026-72716

Orval (a TypeScript client generator from OpenAPI/Swagger specs) prior to 8.21.0 is vulnerable to import-time remote code execution . The root cause is in packages/zod/src/index.ts, function formatDefaultValue: a ${...} expression or backtick in a query parameter default is emitted into a module-...

CVE-2026-72716 Orval: Import-time RCE via query-parameter default -> zod module-level template literal

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a $... expression or backtick in a query parameter default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permit...

CVE-2026-62681 Orval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout)

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, an unescaped backtick in an OpenAPI path is emitted into request URL template literals generated for axios, fetch, react-query, and SWR clients without safe encoding. This...

CVE-2026-62681

In Orval

CVE-2026-62681 Orval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout)

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, an unescaped backtick in an OpenAPI path is emitted into request URL template literals generated for axios, fetch, react-query, and SWR clients without safe encoding. This...

CVE-2026-61536

A flaw was found in Banks, a tool for generating LLM prompts. This vulnerability allows a remote attacker to achieve arbitrary code execution by injecting a malicious tool definition into a template. The system improperly resolves the path specified in this definition, enabling the attacker to...

Duplicate Advisory: GitPython: Unguarded git option forwarding in Repo.init enables arbitrary command execution via --template clone hooks

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-9rj7-rf2p-w77r. This link is maintained to preserve external references. Original Description GitPython before 3.1.58 contains a remote code execution vulnerability in Repo.init that forwards unsafe git options...

CVE-2026-52889

Formie is a Craft CMS plugin for creating forms. Prior to 3.1.27, Formie can pass request-derived Hidden field defaults such as HTTP User Agent, Referer URL, Current URL, Current URL without Query String, Query Parameter, and Cookie Value to Craft's Twig rendering layer during front-end form...

CVE-2026-40508

OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability in the patient portal template import handler that allows authenticated attackers with Forms Administration permissions to upload template files containing arbitrary HTML or JavaScript. Attackers can inject malicious script...