NPM: Orval: Import-time RCE via array-items default -> zod module-level template literal

NPM: Orval: Import-time RCE via array-items default - zod module-level template literal vulnerability discovered by ? in WordPress Npm orval versions 8.21.0...

Orval: Import-time RCE via array-items default -> zod module-level template literal

Summary Orval's zod schema generation emits the array-items default value as a module-level template literal export const …Default = ; without escaping $ or the backtick. A default of the form v$w injects a live JavaScript expression evaluated when the generated zod schema module is imported,...

NPM: Orval: Import-time RCE via header-parameter default -> zod module-level template literal

NPM: Orval: Import-time RCE via header-parameter default - zod module-level template literal vulnerability discovered by ? in WordPress Npm orval versions 8.21.0...

GHSA-8J6P-R8JG-MXQH Orval: Import-time RCE via header-parameter default -> zod module-level template literal

Summary Orval's zod schema generation emits the header-parameter default value as a module-level template literal export const Default = ; without escaping $ or the backtick. A default of the form v$w injects a live JavaScript expression evaluated when the generated zod schema module is imported,...

Orval: Import-time RCE via header-parameter default -> zod module-level template literal

Summary Orval's zod schema generation emits the header-parameter default value as a module-level template literal export const Default = ; without escaping $ or the backtick. A default of the form v$w injects a live JavaScript expression evaluated when the generated zod schema module is imported,...

Orval: Import-time RCE via enum-typed default -> zod module-level template literal

Summary Orval's zod schema generation emits the enum-typed default value as a module-level template literal export const …Default = ; without escaping $ or the backtick. A default of the form v$w injects a live JavaScript expression evaluated when the generated zod schema module is imported,...

GHSA-3575-W9FC-C2J6 Orval: Import-time RCE via enum-typed default -> zod module-level template literal

Summary Orval's zod schema generation emits the enum-typed default value as a module-level template literal export const …Default = ; without escaping $ or the backtick. A default of the form v$w injects a live JavaScript expression evaluated when the generated zod schema module is imported,...

NPM: Orval: Import-time RCE via enum-typed default -> zod module-level template literal

NPM: Orval: Import-time RCE via enum-typed default - zod module-level template literal vulnerability discovered by ? in WordPress Npm orval versions 8.21.0...

GHSA-653Q-5476-X79G Orval: Import-time RCE via query parameter name -> computed-property-key injection in the zod cli

Summary orval's zod client emits each query parameter name as a double-quoted key in the generated zod.object... request-validation schema WITHOUT escaping the double quote. A " in the query parameter name closes the key and lands in object-literal context, where an injected computed property key...

Orval: Import-time RCE via query parameter name -> computed-property-key injection in the zod cli

Summary orval's zod client emits each query parameter name as a double-quoted key in the generated zod.object... request-validation schema WITHOUT escaping the double quote. A " in the query parameter name closes the key and lands in object-literal context, where an injected computed property key...

NPM: Orval: Import-time RCE via query parameter name -> computed-property-key injection in the zod cli

NPM: Orval: Import-time RCE via query parameter name - computed-property-key injection in the zod cli vulnerability discovered by ? in WordPress Npm orval versions 8.21.0...

GHSA-6437-GXHQ-PQV8 Orval: Import-time RCE via header parameter name -> computed-property-key injection in the zod client

Summary orval's zod client emits each header parameter name as a double-quoted key in the generated zod.object... request-validation schema WITHOUT escaping the double quote. A " in the header parameter name closes the key and lands in object-literal context, where an injected computed property k...

Orval: Import-time RCE via header parameter name -> computed-property-key injection in the zod client

Summary orval's zod client emits each header parameter name as a double-quoted key in the generated zod.object... request-validation schema WITHOUT escaping the double quote. A " in the header parameter name closes the key and lands in object-literal context, where an injected computed property k...

NPM: Orval: Import-time RCE via header parameter name -> computed-property-key injection in the zod client

NPM: Orval: Import-time RCE via header parameter name - computed-property-key injection in the zod client vulnerability discovered by ? in WordPress Npm orval versions 8.21.0...

Malicious code in py-2equests (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9bd7b93cf88d0fbcca30c50d9c9de6e14134cd2890be5a7a785e9330e98a988c py-2equests is a typosquat of the popular 'requests' package substituting '2' for 'r'. On import py2equests, the top-level module body iterates...

Malicious code in py-0requests (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd1f4c6176eadca0e4a460d4434e9957eb9befa90d85feecd49e4baf7f3abb4b py-0requests is a homoglyph typosquat of the PyPI package requests letter o replaced with digit 0. On import py0requests, top-level code in the...

MAL-2026-15860 Malicious code in py-0requests (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd1f4c6176eadca0e4a460d4434e9957eb9befa90d85feecd49e4baf7f3abb4b py-0requests is a homoglyph typosquat of the PyPI package requests letter o replaced with digit 0. On import py0requests, top-level code in the...

Malicious code in 0requests (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ce3a594da2523b6481bd4639f5d3aaed9ec11a9adf92c2b99bf99d0ab6fb5b78 The package name '0requests' is a one-character variant of the popular PyPI package 'requests'. On import of the top-level package, init.py enumerate...

CVE-2026-84832

SEPPmail Secure Email Gateway before 15.0.6 deserializes attacker-controlled data in a privileged REST import workflow without adequate validation. An attacker with a privileged API token can execute arbitrary commands with "nobody" privileges...

CVE-2026-84832 Unsafe deserialization in the REST interface

SEPPmail Secure Email Gateway before 15.0.6 deserializes attacker-controlled data in a privileged REST import workflow without adequate validation. An attacker with a privileged API token can execute arbitrary commands with "nobody" privileges...