ROOT-APP-NPM-CVE-2026-71867 CVE-2026-71867 in orval - Patched by Root

Root has patched CVE-2026-71867 in the orval package for Root:npm. Multiple fixed versions available...

CVE-2026-71867

creationtimestamp| type| source ---|---|--- 2026-08-19 20:10:41+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mthjzq365h23 2026-08-19 23:10:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mthu2hdlev23 2026-08-20 00:19:48+00:00| seen|...

CVE-2026-71867 Orval: RCE via schema property name -> computed-property-key injection in the MSW mock generator

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a single quote in a schema property name is emitted into single-quoted object keys in generated MSW mock factories without safe encoding. This permits attacker-controlled...