GHSA-6437-GXHQ-PQV8 Orval: Import-time RCE via header parameter name -> computed-property-key injection in the zod client

Summary orval's zod client emits each header parameter name as a double-quoted key in the generated zod.object... request-validation schema WITHOUT escaping the double quote. A " in the header parameter name closes the key and lands in object-literal context, where an injected computed property k...

Orval: Import-time RCE via header parameter name -> computed-property-key injection in the zod client

Summary orval's zod client emits each header parameter name as a double-quoted key in the generated zod.object... request-validation schema WITHOUT escaping the double quote. A " in the header parameter name closes the key and lands in object-literal context, where an injected computed property k...

NPM: Orval: Import-time RCE via header parameter name -> computed-property-key injection in the zod client

NPM: Orval: Import-time RCE via header parameter name - computed-property-key injection in the zod client vulnerability discovered by ? in WordPress Npm orval versions 8.21.0...

Malicious code in py-2equests (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9bd7b93cf88d0fbcca30c50d9c9de6e14134cd2890be5a7a785e9330e98a988c py-2equests is a typosquat of the popular 'requests' package substituting '2' for 'r'. On import py2equests, the top-level module body iterates...

Malicious code in py-0requests (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd1f4c6176eadca0e4a460d4434e9957eb9befa90d85feecd49e4baf7f3abb4b py-0requests is a homoglyph typosquat of the PyPI package requests letter o replaced with digit 0. On import py0requests, top-level code in the...

MAL-2026-15828 Malicious code in env-validator-tool (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dd6cff735ec80019a9009add49ea47ae4b34ec0c29c1e287511d765c24300964 The package ships no source module only egg-info metadata despite declaring a consolescript entrypoint 'env-validator=envvalidator.cli:main' that...

NPM: Orval: Import-time RCE via query-parameter default -> zod module-level template literal

NPM: Orval: Import-time RCE via query-parameter default - zod module-level template literal vulnerability discovered by ? in WordPress Npm orval versions 8.21.0...

Orval: Import-time RCE via query-parameter default -> zod module-level template literal

Summary Orval's zod schema generation emits the query-parameter default value as a module-level template literal export const …Default = ; without escaping $ or the backtick. A default of the form v$w injects a live JavaScript expression evaluated when the generated zod schema module is imported,...

GHSA-P4CG-3328-RVFG Orval: Import-time RCE via query-parameter default -> zod module-level template literal

Summary Orval's zod schema generation emits the query-parameter default value as a module-level template literal export const …Default = ; without escaping $ or the backtick. A default of the form v$w injects a live JavaScript expression evaluated when the generated zod schema module is imported,...

Orval: Import-time RCE via schema property name -> computed-property-key injection in the zod client

Summary orval's zod client emits each schema property name as a double-quoted key in the generated zod.object... WITHOUT escaping the double quote. A " in a property name closes the key and lands in object-literal context, where an injected computed property key expr is evaluated when zod.object...

GHSA-6MR6-JVCR-2F25 Orval: Import-time RCE via schema property name -> computed-property-key injection in the zod client

Summary orval's zod client emits each schema property name as a double-quoted key in the generated zod.object... WITHOUT escaping the double quote. A " in a property name closes the key and lands in object-literal context, where an injected computed property key expr is evaluated when zod.object...

NPM: Orval: Import-time RCE via schema property name -> computed-property-key injection in the zod client

NPM: Orval: Import-time RCE via schema property name - computed-property-key injection in the zod client vulnerability discovered by ? in WordPress Npm orval versions 8.21.0...

PT-2026-82614

Name of the Vulnerable Software and Affected Versions openssl encrypt versions prior to 1.4.9 Description Insufficient controls during the execution of untrusted third-party plugins allow for arbitrary code execution with the privileges of the user running the software. This occurs because the...

Malicious code in babel-polyfill-plugin-corejs2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 13878d994b01607c379e26646449b7cca95099f9b2eb5be2e1f8e19aeea32eb3 The package advertises itself as a Babel core-js 2 polyfill plugin, but the shipped lib/index.js contains unrelated web3-core-subscriptions boilerpla...

MAL-2026-14371 Malicious code in chai-as-testkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0bf8ab4a811449bd1ba40c637a0eebc0569994d3a3550cf7156c36192abcec31 The package is published as 'chai-as-testkit' with a description referencing vulnerability management, but the tarball ships pino's README, docs/,...

CVE-2026-72717 Orval: Import-time RCE via schema default -> zod module-level template literal

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a $... expression or backtick in a schema default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permits...

CVE-2026-72717 Orval: Import-time RCE via schema default -> zod module-level template literal

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a $... expression or backtick in a schema default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permits...

CVE-2026-72717

CVE-2026-72717 is a critical (CVSS 4.0: 9.3 ) import-time remote code execution vulnerability in Orval , a tool that generates type-safe TypeScript clients from OpenAPI/Swagger specifications. The root cause is in packages/zod/src/index.ts, function formatDefaultValue: a ${...} expression or back...

CVE-2026-71868 Orval: Import-time RCE via enum-typed default -> zod module-level template literal

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a $... expression or backtick in an enum default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permits...

CVE-2026-71868

Orval (a TypeScript client generator from OpenAPI/Swagger specs) is vulnerable to import-time remote code execution prior to version 8.21.0 . The root cause is in packages/zod/src/index.ts function formatDefaultValue: a ${...} expression or backtick in an enum default value is emitted into a modu...