CVE-2026-96756 orval before 8.30.0 Code Injection via Factory Generation

orval versions before 8.30.0 contain a code injection vulnerability in the @orval/core factory generator that fails to escape date default values in new Date calls. Attackers can inject arbitrary expressions through apostrophes in OpenAPI schema defaults to execute code with the privileges of the...

CVE-2026-96756

orval versions before 8.30.0 contain a code injection vulnerability in the @orval/core factory generator that fails to escape date default values in new Date calls. Attackers can inject arbitrary expressions through apostrophes in OpenAPI schema defaults to execute code with the privileges of the...

CVE-2026-96756 orval before 8.30.0 Code Injection via Factory Generation

orval versions before 8.30.0 contain a code injection vulnerability in the @orval/core factory generator that fails to escape date default values in new Date calls. Attackers can inject arbitrary expressions through apostrophes in OpenAPI schema defaults to execute code with the privileges of the...

CVE-2026-96756

Versions of orval prior to 8.30.0 are susceptible to a code injection vulnerability within the @orval/core factory generator. The root cause is a failure to properly escape date default values in new Date() calls. When the factoryMethods and useDates options are enabled, an attacker can inject ar...

EUVD-2026-85405

orval versions 8.14.0 through 8.28.1 contain a code injection vulnerability in the @orval/effect generator that converts OpenAPI schema defaults into template literals. Attackers can inject arbitrary JavaScript expressions via schema defaults containing $... syntax, which are executed at module...

CVE-2026-96755 orval @orval/effect 8.14.0 through 8.28.1 Code Injection

orval versions 8.14.0 through 8.28.1 contain a code injection vulnerability in the @orval/effect generator that converts OpenAPI schema defaults into template literals. Attackers can inject arbitrary JavaScript expressions via schema defaults containing $... syntax, which are executed at module...

CVE-2026-96755 orval @orval/effect 8.14.0 through 8.28.1 Code Injection

orval versions 8.14.0 through 8.28.1 contain a code injection vulnerability in the @orval/effect generator that converts OpenAPI schema defaults into template literals. Attackers can inject arbitrary JavaScript expressions via schema defaults containing $... syntax, which are executed at module...

CVE-2026-96755 orval @orval/effect 8.14.0 through 8.28.1 Code Injection

orval versions 8.14.0 through 8.28.1 contain a code injection vulnerability in the @orval/effect generator that converts OpenAPI schema defaults into template literals. Attackers can inject arbitrary JavaScript expressions via schema defaults containing $... syntax, which are executed at module...

CVE-2026-96755

orval versions 8.14.0 through 8.28.1 contain a code injection vulnerability in the @orval/effect generator that converts OpenAPI schema defaults into template literals. Attackers can inject arbitrary JavaScript expressions via schema defaults containing $... syntax, which are executed at module...

CVE-2026-96755

Versions 8.14.0 through 8.28.1 of orval are vulnerable to a code injection vulnerability within the @orval/effect generator. The root cause is the improper conversion of OpenAPI schema defaults into template literals . An attacker can inject arbitrary JavaScript expressions by including ${...} sy...

CVE-2026-96754 orval @orval/hono before 8.29.0 Code Injection via OpenAPI Path

orval versions before 8.29.0 contain a code injection vulnerability in the @orval/hono generator that fails to escape OpenAPI path values in single-quoted route literals. Attackers can craft an OpenAPI document with an apostrophe in a static path segment to inject arbitrary JavaScript code that...

EUVD-2026-85404

orval versions before 8.29.0 contain a code injection vulnerability in the @orval/hono generator that fails to escape OpenAPI path values in single-quoted route literals. Attackers can craft an OpenAPI document with an apostrophe in a static path segment to inject arbitrary JavaScript code that...

CVE-2026-96754 orval @orval/hono before 8.29.0 Code Injection via OpenAPI Path

orval versions before 8.29.0 contain a code injection vulnerability in the @orval/hono generator that fails to escape OpenAPI path values in single-quoted route literals. Attackers can craft an OpenAPI document with an apostrophe in a static path segment to inject arbitrary JavaScript code that...

CVE-2026-96754 orval @orval/hono before 8.29.0 Code Injection via OpenAPI Path

orval versions before 8.29.0 contain a code injection vulnerability in the @orval/hono generator that fails to escape OpenAPI path values in single-quoted route literals. Attackers can craft an OpenAPI document with an apostrophe in a static path segment to inject arbitrary JavaScript code that...

CVE-2026-96754

orval versions before 8.29.0 contain a code injection vulnerability in the @orval/hono generator that fails to escape OpenAPI path values in single-quoted route literals. Attackers can craft an OpenAPI document with an apostrophe in a static path segment to inject arbitrary JavaScript code that...

CVE-2026-96754

Versions of orval prior to 8.29.0 are vulnerable to a code injection flaw within the @orval/hono generator. The root cause is a failure to properly escape OpenAPI path values in single-quoted route literals. By crafting an OpenAPI document containing an apostrophe in a static path segment, an att...

RHLW-2026-6DD67008E326A981 Lightwell Security Advisory: avro 1.9.2.rhlw-00002

Red Hat Lightwell has released org.apache.avro:avro 1.9.2.rhlw-00002 with backported fixes for CVE-2024-47561 and CVE-2025-33042. CVE-2024-47561: Apache Avro Java SDK: Arbitrary Code Execution when reading Avro schema Java SDK CVE-2025-33042: Apache Avro Java SDK: Code injection on Java generated...

Exploit for Static Code Injection in N-Able N-Central

CVE-2026-86218 - N-able N-central Pre-Auth RCE Exploit Ove...

MSC-2026-11701

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Code injection testing – an attacker checks if...

MSC-2026-11698

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Code injection testing – an attacker checks if...