CVE-2026-96755

orval versions 8.14.0 through 8.28.1 contain a code injection vulnerability in the @orval/effect generator that converts OpenAPI schema defaults into template literals. Attackers can inject arbitrary JavaScript expressions via schema defaults containing $... syntax, which are executed at module...

CVE-2026-96755 orval @orval/effect 8.14.0 through 8.28.1 Code Injection

orval versions 8.14.0 through 8.28.1 contain a code injection vulnerability in the @orval/effect generator that converts OpenAPI schema defaults into template literals. Attackers can inject arbitrary JavaScript expressions via schema defaults containing $... syntax, which are executed at module...

d2m-apigen (>=1.0.1, <=2.1.7), dm-apigen (>=0.0.0, <=1.0.0) +3 more potentially affected by CVE-2026-24132 via @orval/mock (>=7.0.0, <=7.19.0)

@orval/mock NPM version =7.0.0, =1.0.1, =0.0.0, =1.2.0, =7.0.0, =7.1.0, =7.13.2 Source cves: CVE-2026-24132 Source advisory: OSV:GHSA-F456-RF33-4626...

d2m-apigen (>=1.0.1, <=2.1.7), orval (>=7.9.0, <=7.17.2) +1 more potentially affected by CVE-2026-22785 via @orval/mcp (>=7.9.0, <=7.17.2)

@orval/mcp NPM version =7.9.0, =1.0.1, =7.9.0, =7.9.0, =7.13.2 Source cves: CVE-2026-22785 Source advisory: OSV:GHSA-MWR6-3GP8-9JMJ...

d2m-apigen (>=1.0.1, <=2.1.7), orval (>=7.9.0, <=7.17.2) +1 more potentially affected by CVE-2026-22785 via @orval/mcp (>=7.9.0, <=7.17.2)

@orval/mcp NPM version =7.9.0, =1.0.1, =7.9.0, =7.9.0, =7.13.2 Source cves: CVE-2026-22785 Source advisory: SNYK:JS-ORVALMCP-14928070...