@testurio/cli (>=0.6.3, <=0.7.3) potentially affected by CVE-2026-71867 via orval (8.5.3)

orval NPM version 8.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on orval and may be impacted: - @testurio/cli =0.6.3, =0.7.3 Source cves: CVE-2026-71867 Source advisory: OSV:GHSA-2W86-XFRC-G85R...

CVE-2026-71867

creationtimestamp| type| source ---|---|--- 2026-08-19 20:10:41+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mthjzq365h23 2026-08-19 23:10:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mthu2hdlev23 2026-08-20 00:19:48+00:00| seen|...

CVE-2026-71867 Orval: RCE via schema property name -> computed-property-key injection in the MSW mock generator

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a single quote in a schema property name is emitted into single-quoted object keys in generated MSW mock factories without safe encoding. This permits attacker-controlled...