@hanzo/openapi-codegen (0.0.0), @testurio/cli (>=0.6.3, <=0.7.3) +3 more potentially affected by CVE-2026-96757 via @orval/mock (>=8.4.0, <=8.28.1)

@orval/mock NPM version =8.4.0, =0.6.3, =8.9.1, =8.7.0-patch1, =8.4.0, =8.28.1 Source cves: CVE-2026-96757 Source advisory: MEND:CVE-2026-96757...

orval (>=8.0.0-rc.0, <=8.0.2) potentially affected by CVE-2026-24132 via @orval/mock (>=8.0.0-rc.0, <=8.0.2)

@orval/mock NPM version =8.0.0-rc.0, =8.0.0-rc.0, =8.0.2 Source cves: CVE-2026-24132 Source advisory: SNYK:JS-ORVALMOCK-15091570...

Arbitrary Command Injection

Overview Affected versions of this package are vulnerable to Arbitrary Command Injection via the getMockScalar function. An attacker can execute arbitrary code by supplying a crafted OpenAPI specification containing malicious values in the const property, which are then interpolated into generate...

orval (>=8.0.0-rc.0, <=8.0.2) potentially affected by CVE-2026-24132 via @orval/mock (>=8.0.0-rc.0, <=8.0.2)

@orval/mock NPM version =8.0.0-rc.0, =8.0.0-rc.0, =8.0.2 Source cves: CVE-2026-24132 Source advisory: MEND:CVE-2026-24132...

@dohyper/cli.hyper (>=0.0.1, <=0.0.10), @lumeweb/portal-sdk (>=0.0.0-20240306223335, <=0.0.2) +17 more potentially affected by CVE-2026-24132 via @orval/mock (>=6.21.0, <=7.19.0)

@orval/mock NPM version =6.21.0, =0.0.1, =0.0.0-20240306223335, =1.0.0, =0.1.0, =1.0.0, =1.2.0, =1.9.101, =1.9.101, =1.0.1, =0.0.0, =1.2.0, =2.3.0 and more Source cves: CVE-2026-24132 Source advisory: MEND:CVE-2026-24132...

d2m-apigen (>=1.0.1, <=2.1.7), dm-apigen (>=0.0.0, <=1.0.0) +3 more potentially affected by CVE-2026-24132 via @orval/mock (>=7.0.0, <=7.19.0)

@orval/mock NPM version =7.0.0, =1.0.1, =0.0.0, =1.2.0, =7.0.0, =7.1.0, =7.13.2 Source cves: CVE-2026-24132 Source advisory: OSV:GHSA-F456-RF33-4626...

orval (>=8.0.0-rc.0, <=8.0.2) potentially affected by CVE-2026-24132 via @orval/mock (>=8.0.0-rc.0, <=8.0.2)

@orval/mock NPM version =8.0.0-rc.0, =8.0.0-rc.0, =8.0.2 Source cves: CVE-2026-24132 Source advisory: GHSA-F456-RF33-4626...

d2m-apigen (>=1.0.1, <=2.1.7), dm-apigen (>=0.0.0, <=1.0.0) +3 more potentially affected by CVE-2026-24132 via @orval/mock (>=7.0.0, <=7.19.0)

@orval/mock NPM version =7.0.0, =1.0.1, =0.0.0, =1.2.0, =7.0.0, =7.1.0, =7.13.2 Source cves: CVE-2026-24132 Source advisory: GHSA-F456-RF33-4626...

orval (>=8.0.0-rc.0, <=8.0.2) potentially affected by CVE-2026-24132 via @orval/mock (>=8.0.0-rc.0, <=8.0.2)

@orval/mock NPM version =8.0.0-rc.0, =8.0.0-rc.0, =8.0.2 Source cves: CVE-2026-24132 Source advisory: OSV:GHSA-F456-RF33-4626...

Orval Mock Generation Code Injection via const

I am reporting a code injection vulnerability in Orval’s mock generation pipeline affecting @orval/mock in both the 7.x and 8.x series. This issue is related in impact to the previously reported enum x-enumDescriptions https://github.com/advisories/GHSA-h526-wf6g-67jv, but it affects a different...