ROOT-APP-NPM-CVE-2026-71867 CVE-2026-71867 in orval - Patched by Root

Root has patched CVE-2026-71867 in the orval package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-71866 CVE-2026-71866 in orval - Patched by Root

Root has patched CVE-2026-71866 in the orval package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-71869 CVE-2026-71869 in orval - Patched by Root

Root has patched CVE-2026-71869 in the orval package for Root:npm. Multiple fixed versions available...

CVE-2026-23947-PoC

Walkthrough: CVE-2026-23947 - Orval Arbitrary Code Execution This walkthrough demonstrates how an untrusted OpenAPI specification can exploit Orval to inject arbitrary code into generated clients via the x-enumDescriptions and x-enumNames fields. Prerequisites Node.js v20 or v22 npm Setup 1. Crea...

CVE-2026-22785

Tutorial de reproducción de CVE-2026-22785 Resumen de la vulnerabilidad CVE : CVE-2026-22785 Impacto : orval = 7.18.0 CVSS : 9.3 CRÍTICO Tipo : Inyección de código Principio de la vulnerabilidad orval 7.18.0, al generar código de servidor MCP, concatena directamente el campo summary de la...

EUVD-2026-62599

Orval: RCE via OpenAPI path - unescaped request-URL template literal backtick breakout...

@testurio/cli (>=0.6.3, <=0.7.3) potentially affected by CVE-2026-62681 via orval (8.5.3)

orval NPM version 8.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on orval and may be impacted: - @testurio/cli =0.6.3, =0.7.3 Source cves: CVE-2026-62681 Source advisory: OSV:GHSA-FG9P-MRXR-HVQ7...

Orval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout)

Summary Orval emits the OpenAPI path into the generated request URL as a TEMPLATE LITERAL /users/... without escaping the backtick character. A path containing a backtick closes the template literal and injects a concatenation expression that is evaluated when the generated URL/request/key functi...

@testurio/cli (>=0.6.3, <=0.7.3) potentially affected by CVE-2026-62682 via orval (8.5.3)

orval NPM version 8.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on orval and may be impacted: - @testurio/cli =0.6.3, =0.7.3 Source cves: CVE-2026-62682 Source advisory: OSV:GHSA-88F2-FPV8-89Q2...

EUVD-2026-62658

Orval: RCE via servers.url - unescaped request-URL template literal with getBaseUrlFromSpecification...

Orval: RCE via servers[].url -> unescaped request-URL template literal (with getBaseUrlFromSpecification)

Summary When Orval is configured with output.baseUrl.getBaseUrlFromSpecification: true, it bakes the spec's servers0.url into the generated request URL as a template literal without escaping the backtick. A server URL containing a backtick closes the template literal and injects a concatenation...

EUVD-2026-62657

Orval: Import-time RCE via schema default - zod module-level template literal...

@testurio/cli (>=0.6.3, <=0.7.3) potentially affected by CVE-2026-72717 via orval (8.5.3)

orval NPM version 8.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on orval and may be impacted: - @testurio/cli =0.6.3, =0.7.3 Source cves: CVE-2026-72717 Source advisory: OSV:GHSA-W727-8J6C-2RJ4...

Orval: Import-time RCE via schema default -> zod module-level template literal

Summary Orval's zod schema generation emits a schema's default value as a module-level template literal export const …Default = ; without escaping $ or the backtick. A default of the form v$w injects a live JavaScript expression that is evaluated when the generated zod schema module is imported,...

@testurio/cli (>=0.6.3, <=0.7.3) potentially affected by CVE-2026-71869 via orval (8.5.3)

orval NPM version 8.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on orval and may be impacted: - @testurio/cli =0.6.3, =0.7.3 Source cves: CVE-2026-71869 Source advisory: OSV:GHSA-2H9G-J24R-H63G...

EUVD-2026-62603

Orval: Import-time RCE via array-items default - zod module-level template literal...

Orval: Import-time RCE via array-items default -> zod module-level template literal

Summary Orval's zod schema generation emits the array-items default value as a module-level template literal export const …Default = ; without escaping $ or the backtick. A default of the form v$w injects a live JavaScript expression evaluated when the generated zod schema module is imported,...

Orval: Import-time RCE via header-parameter default -> zod module-level template literal

Summary Orval's zod schema generation emits the header-parameter default value as a module-level template literal export const Default = ; without escaping $ or the backtick. A default of the form v$w injects a live JavaScript expression evaluated when the generated zod schema module is imported,...

EUVD-2026-62601

Orval: Import-time RCE via header-parameter default - zod module-level template literal...

@testurio/cli (>=0.6.3, <=0.7.3) potentially affected by CVE-2026-71871 via orval (8.5.3)

orval NPM version 8.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on orval and may be impacted: - @testurio/cli =0.6.3, =0.7.3 Source cves: CVE-2026-71871 Source advisory: OSV:GHSA-8J6P-R8JG-MXQH...