16656 matches found
GHSA-88F2-FPV8-89Q2 Orval: RCE via servers[].url -> unescaped request-URL template literal (with getBaseUrlFromSpecification)
Summary When Orval is configured with output.baseUrl.getBaseUrlFromSpecification: true, it bakes the spec's servers0.url into the generated request URL as a template literal without escaping the backtick. A server URL containing a backtick closes the template literal and injects a concatenation...
Orval: RCE via servers[].url -> unescaped request-URL template literal (with getBaseUrlFromSpecification)
Summary When Orval is configured with output.baseUrl.getBaseUrlFromSpecification: true, it bakes the spec's servers0.url into the generated request URL as a template literal without escaping the backtick. A server URL containing a backtick closes the template literal and injects a concatenation...
EUVD-2026-62657
Orval: Import-time RCE via schema default - zod module-level template literal...
NPM: Orval: Import-time RCE via schema default -> zod module-level template literal
NPM: Orval: Import-time RCE via schema default - zod module-level template literal vulnerability discovered by ? in WordPress Npm orval versions 8.21.0...
GHSA-W727-8J6C-2RJ4 Orval: Import-time RCE via schema default -> zod module-level template literal
Summary Orval's zod schema generation emits a schema's default value as a module-level template literal export const …Default = ; without escaping $ or the backtick. A default of the form v$w injects a live JavaScript expression that is evaluated when the generated zod schema module is imported,...
Orval: Import-time RCE via schema default -> zod module-level template literal
Summary Orval's zod schema generation emits a schema's default value as a module-level template literal export const …Default = ; without escaping $ or the backtick. A default of the form v$w injects a live JavaScript expression that is evaluated when the generated zod schema module is imported,...
EUVD-2026-62603
Orval: Import-time RCE via array-items default - zod module-level template literal...
NPM: Orval: Import-time RCE via array-items default -> zod module-level template literal
NPM: Orval: Import-time RCE via array-items default - zod module-level template literal vulnerability discovered by ? in WordPress Npm orval versions 8.21.0...
GHSA-2H9G-J24R-H63G Orval: Import-time RCE via array-items default -> zod module-level template literal
Summary Orval's zod schema generation emits the array-items default value as a module-level template literal export const …Default = ; without escaping $ or the backtick. A default of the form v$w injects a live JavaScript expression evaluated when the generated zod schema module is imported,...
Orval: Import-time RCE via array-items default -> zod module-level template literal
Summary Orval's zod schema generation emits the array-items default value as a module-level template literal export const …Default = ; without escaping $ or the backtick. A default of the form v$w injects a live JavaScript expression evaluated when the generated zod schema module is imported,...
CVE-2026-78593
Kibana 's Cribl integration contains an insufficiently validated configuration field that allows an authenticated user with Kibana Fleet management privileges to inject attacker-controlled expressions into a server-side script template. This results in an Elasticsearch ingest pipeline being writt...
EUVD-2026-70658
An insufficiently validated configuration field in Kibana's Cribl integration allows an authenticated user holding Kibana Fleet management privileges to inject attacker-controlled expressions into a server-side script template, resulting in an Elasticsearch ingest pipeline being written beyond th...
CVE-2026-78593 Improper Control of Generation of Code in Kibana Leading to Privilege Escalation
An insufficiently validated configuration field in Kibana's Cribl integration allows an authenticated user holding Kibana Fleet management privileges to inject attacker-controlled expressions into a server-side script template, resulting in an Elasticsearch ingest pipeline being written beyond th...
CVE-2026-61556
creationtimestamp| type| source ---|---|--- 2026-09-03 18:35:04+00:00| published-proof-of-concept| https://github.com/harttle/liquidjs/security/advisories/GHSA-m7fp-h3p4-hr49...
io.quarkus:quarkus-qute: quarkus-qute:Server-Side Template Injection (SSTI) vulnerability in ReflectionValueResolver of the Quarkus Qute template engine
A flaw was found in the Qute template engine, which is used by Quarkus to generate dynamic content like HTML pages or emails. The issue exists in the component responsible for looking up data values ReflectionValueResolver, which fails to properly block access to sensitive Java internal functions...
GHSA-8J6P-R8JG-MXQH Orval: Import-time RCE via header-parameter default -> zod module-level template literal
Summary Orval's zod schema generation emits the header-parameter default value as a module-level template literal export const Default = ; without escaping $ or the backtick. A default of the form v$w injects a live JavaScript expression evaluated when the generated zod schema module is imported,...
NPM: Orval: Import-time RCE via header-parameter default -> zod module-level template literal
NPM: Orval: Import-time RCE via header-parameter default - zod module-level template literal vulnerability discovered by ? in WordPress Npm orval versions 8.21.0...
EUVD-2026-62601
Orval: Import-time RCE via header-parameter default - zod module-level template literal...
Orval: Import-time RCE via header-parameter default -> zod module-level template literal
Summary Orval's zod schema generation emits the header-parameter default value as a module-level template literal export const Default = ; without escaping $ or the backtick. A default of the form v$w injects a live JavaScript expression evaluated when the generated zod schema module is imported,...