74 matches found
CVE-2026-71871
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a $... expression or backtick in a header parameter default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permi...
CVE-2026-71864
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a double quote in a header parameter name is emitted into the generated request-validation zod.object... schema without safe encoding. This permits attacker-controlled...
EUVD-2026-62602
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a double quote in a header parameter name is emitted into the generated request-validation zod.object... schema without safe encoding. This permits attacker-controlled...
CVE-2026-71864
Orval (a TypeScript client generator for OpenAPI/Swagger specs) is vulnerable to import-time remote code execution prior to version 8.21.0 . A double quote in a header parameter name is emitted unencoded into the generated zod.object({...}) schema in packages/zod/src/index.ts, enabling computed-p...
CVE-2026-71864 Orval: Import-time RCE via header parameter name -> computed-property-key injection in the zod client
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a double quote in a header parameter name is emitted into the generated request-validation zod.object... schema without safe encoding. This permits attacker-controlled...
CVE-2026-71864 Orval: Import-time RCE via header parameter name -> computed-property-key injection in the zod client
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a double quote in a header parameter name is emitted into the generated request-validation zod.object... schema without safe encoding. This permits attacker-controlled...
EUVD-2026-62601
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a $... expression or backtick in a header parameter default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permi...
CVE-2026-71871 Orval: Import-time RCE via header-parameter default -> zod module-level template literal
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a $... expression or backtick in a header parameter default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permi...
CVE-2026-71871
Orval (pre-8.21.0) emits unescaped ${...} or backtick strings from OpenAPI header-parameter defaults into a module-level template literal in generated zod schema code (packages/zod/src/index.ts function formatDefaultValue). Importing the generated module evaluates the attacker-controlled JavaScri...
CVE-2026-71871 Orval: Import-time RCE via header-parameter default -> zod module-level template literal
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a $... expression or backtick in a header parameter default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permi...
PT-2026-78554
Name of the Vulnerable Software and Affected Versions Orval versions prior to 8.21.0 Description Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. A flaw exists where a $... expression or backtick in a header parameter default is emitted int...
Astra Linux – Vulnerability in pyjwt
PyJWT is an implementation of JSON Web Tokens in Python. Before version 2.12.0, PyJWT did not validate the Critical Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a critical array listing extensions that PyJWT does not understand, the library accepts the token instead of...
Unity Linux 20.1060e / 20.1070e Security Update: ganglia (UTSA-2026-016666)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-016666 advisory. ganglia-web aka Ganglia Web Frontend through 3.7.5 allows XSS via the header.php ce parameter. Tenable has extracted the preceding description block directly from th...
Debian dsa-6259 : python-jwt-doc - security update
The remote Debian 12 / 13 host has packages installed that are affected by a vulnerability as referenced in the dsa-6259 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6259-1 [email protected] https://www.debian.org/security/...
TOTOLINK WA300 缓冲区错误漏洞
TOTOLINK WA300 is a wireless access point produced by TOTOLINK, a Chinese company. The TOTOLINK WA300 5.2cu.7112B20190227 version contains a buffer overflow vulnerability. This vulnerability stems from the operation of the loginauth function in the POST Request Handler component’s file...
pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)
A missing verification step has been discovered in PyJWT. PyJWT does not validate the crit Critical Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the library accepts the token instead of rejecting it. This...
EUVD-2026-23840
A security vulnerability has been detected in rowboatlabs rowboat up to 0.1.67. This impacts the function toolcall of the file apps/experimental/toolswebhook/app.py of the component toolswebhook. Such manipulation of the argument X-Tools-JWE leads to improper authentication. The attack may be...
CVE-2026-35042
fast-jwt provides fast JSON Web Token JWT implementation. In 6.1.0 and earlier, fast-jwt does not validate the crit Critical Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a crit array listing extensions that fast-jwt does not understand, the library accepts the token...
CVE-2026-35042
fast-jwt provides fast JSON Web Token JWT implementation. In 6.1.0 and earlier, fast-jwt does not validate the crit Critical Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a crit array listing extensions that fast-jwt does not understand, the library accepts the token...
GHSA-HM7R-C7QW-GHP6 fast-jwt accepts unknown `crit` header extensions (RFC 7515 violation)
Summary fast-jwt does not validate the crit Critical Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a crit array listing extensions that fast-jwt does not understand, the library accepts the token instead of rejecting it. This violates the MUST requirement in the RFC. ---...