d2m-apigen (>=1.0.1, <=2.1.7), orval (>=7.9.0, <=7.17.2) +1 more potentially affected by CVE-2026-22785 via @orval/mcp (>=7.9.0, <=7.17.2)

@orval/mcp NPM version =7.9.0, =1.0.1, =7.9.0, =7.9.0, =7.13.2 Source cves: CVE-2026-22785 Source advisory: OSV:GHSA-MWR6-3GP8-9JMJ...

d2m-apigen (>=1.0.1, <=2.1.7), orval (>=7.9.0, <=7.17.2) +1 more potentially affected by CVE-2026-22785 via @orval/mcp (>=7.9.0, <=7.17.2)

@orval/mcp NPM version =7.9.0, =1.0.1, =7.9.0, =7.9.0, =7.13.2 Source cves: CVE-2026-22785 Source advisory: SNYK:JS-ORVALMCP-14928070...

CVE-2026-22785

creationtimestamp| type| source ---|---|--- 2026-01-12 20:07:33+00:00| seen| Telegram/H1nFRtyRiOhcROcf0NE40bSu4SNvkoqq4ZeM2FsiV7bGxI 2026-01-12 22:35:39+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mcb3zcir3q2q 2026-01-12 22:40:39+00:00| seen|...

CVE-2026-22785

Summary: Orval (MCP client/server code path) is vulnerable to arbitrary code execution via unsanitized input in OpenAPI specs. The CVE-2026-22785/MCP issue arises from string-manipulation in the MCP server generation logic that embeds the summary field without proper validation/escaping, allowing...