EUVD-2026-62599

Orval: RCE via OpenAPI path - unescaped request-URL template literal backtick breakout...

Orval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout)

Summary Orval emits the OpenAPI path into the generated request URL as a TEMPLATE LITERAL /users/... without escaping the backtick character. A path containing a backtick closes the template literal and injects a concatenation expression that is evaluated when the generated URL/request/key functi...

GHSA-FG9P-MRXR-HVQ7 Orval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout)

Summary Orval emits the OpenAPI path into the generated request URL as a TEMPLATE LITERAL /users/... without escaping the backtick character. A path containing a backtick closes the template literal and injects a concatenation expression that is evaluated when the generated URL/request/key functi...

GHSA-88F2-FPV8-89Q2 Orval: RCE via servers[].url -> unescaped request-URL template literal (with getBaseUrlFromSpecification)

Summary When Orval is configured with output.baseUrl.getBaseUrlFromSpecification: true, it bakes the spec's servers0.url into the generated request URL as a template literal without escaping the backtick. A server URL containing a backtick closes the template literal and injects a concatenation...

Orval: RCE via servers[].url -> unescaped request-URL template literal (with getBaseUrlFromSpecification)

Summary When Orval is configured with output.baseUrl.getBaseUrlFromSpecification: true, it bakes the spec's servers0.url into the generated request URL as a template literal without escaping the backtick. A server URL containing a backtick closes the template literal and injects a concatenation...

GHSA-W727-8J6C-2RJ4 Orval: Import-time RCE via schema default -> zod module-level template literal

Summary Orval's zod schema generation emits a schema's default value as a module-level template literal export const …Default = ; without escaping $ or the backtick. A default of the form v$w injects a live JavaScript expression that is evaluated when the generated zod schema module is imported,...

Orval: Import-time RCE via schema default -> zod module-level template literal

Summary Orval's zod schema generation emits a schema's default value as a module-level template literal export const …Default = ; without escaping $ or the backtick. A default of the form v$w injects a live JavaScript expression that is evaluated when the generated zod schema module is imported,...

GHSA-2H9G-J24R-H63G Orval: Import-time RCE via array-items default -> zod module-level template literal

Summary Orval's zod schema generation emits the array-items default value as a module-level template literal export const …Default = ; without escaping $ or the backtick. A default of the form v$w injects a live JavaScript expression evaluated when the generated zod schema module is imported,...

EUVD-2026-62605

Orval: Import-time RCE via enum-typed default - zod module-level template literal...

GHSA-3575-W9FC-C2J6 Orval: Import-time RCE via enum-typed default -> zod module-level template literal

Summary Orval's zod schema generation emits the enum-typed default value as a module-level template literal export const …Default = ; without escaping $ or the backtick. A default of the form v$w injects a live JavaScript expression evaluated when the generated zod schema module is imported,...

io.javalin.community.openapi:javalin-redoc-plugin (>=5.0.0, <=5.2.0), io.javalin.community.openapi:openapi-test (>=5.0.0, <=5.0.1) +41 more potentially affected by CVE-2026-84375 via org.webjars.npm:js-yaml (>=3.1.0, <=4.3.1)

org.webjars.npm:js-yaml MAVEN version =3.1.0, =5.0.0, =5.0.0, =9.0.6, =2.0.0, =2.1.3, =0.1.3, =1.1.4, =2.1.0, =4.0.3 and more Source cves: CVE-2026-84375 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-19496769...

CVE-2026-53508

oasdiff is a command-line and Go package that compares and detects breaking changes in OpenAPI specs. From version 1.13.2 through version 1.18.0, oasdiff did not enforce --allow-external-refs=false library: openapi3.Loader.IsExternalRefsAllowed = false when loading a spec from a git revision the...

CVE-2026-53507 oasdiff actions resolve external $refs by default, enabling SSRF and disclosure of structured files on pull-request runs

oasdiff-action is a GitHub Action that detects breaking changes in OpenAPI specs and post a review on every pull request. Before version 0.0.51, the oasdiff actions resolved external $refs in the OpenAPI spec by default allow-external-refs: true. When an action runs on a pull request whose spec i...

CVE-2026-53507 oasdiff actions resolve external $refs by default, enabling SSRF and disclosure of structured files on pull-request runs

oasdiff-action is a GitHub Action that detects breaking changes in OpenAPI specs and post a review on every pull request. Before version 0.0.51, the oasdiff actions resolved external $refs in the OpenAPI spec by default allow-external-refs: true. When an action runs on a pull request whose spec i...

CVE-2026-53508

oasdiff (a Go command-line tool and package for comparing OpenAPI specs, hosted at github.com/oasdiff/oasdiff ) failed to enforce the --allow-external-refs=false flag on the git-revision load path (rev:path form, e.g. main:openapi.yaml). From version 1.13.2 through 1.18.0 , external $refs were re...

CVE-2026-53508 oasdiff does not enforce --allow-external-refs=false on the git-revision load path (SSRF / local file read)

oasdiff is a command-line and Go package that compares and detects breaking changes in OpenAPI specs. From version 1.13.2 through version 1.18.0, oasdiff did not enforce --allow-external-refs=false library: openapi3.Loader.IsExternalRefsAllowed = false when loading a spec from a git revision the...

CVE-2026-53508 oasdiff does not enforce --allow-external-refs=false on the git-revision load path (SSRF / local file read)

oasdiff is a command-line and Go package that compares and detects breaking changes in OpenAPI specs. From version 1.13.2 through version 1.18.0, oasdiff did not enforce --allow-external-refs=false library: openapi3.Loader.IsExternalRefsAllowed = false when loading a spec from a git revision the...

CVE-2026-79747

MCPHub , a hub for centrally managing and orchestrating multiple MCP servers/APIs, is vulnerable to SSRF prior to version 1.0.32. An authenticated non-admin user can register a server pointing at an arbitrary URL, causing the hub to issue server-side requests with no egress filtering (loopback, R...

CVE-2026-79747 MCPHub vulnerable to SSRF: a non-admin user can make mcphub request arbitrary URLs and read the response (OpenAPI proxy + transport dial)

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 1.0.32, an authenticated non-admin user can register a server pointing at an arbitrary URL and make the hub issue...

EUVD-2026-68687

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 1.0.32, an authenticated non-admin user can register a server pointing at an arbitrary URL and make the hub issue...