NPM: Orval: Import-time RCE via query-parameter default -> zod module-level template literal

NPM: Orval: Import-time RCE via query-parameter default - zod module-level template literal vulnerability discovered by ? in WordPress Npm orval versions 8.21.0...

Orval: Import-time RCE via schema property name -> computed-property-key injection in the zod client

Summary orval's zod client emits each schema property name as a double-quoted key in the generated zod.object... WITHOUT escaping the double quote. A " in a property name closes the key and lands in object-literal context, where an injected computed property key expr is evaluated when zod.object...

GHSA-6MR6-JVCR-2F25 Orval: Import-time RCE via schema property name -> computed-property-key injection in the zod client

Summary orval's zod client emits each schema property name as a double-quoted key in the generated zod.object... WITHOUT escaping the double quote. A " in a property name closes the key and lands in object-literal context, where an injected computed property key expr is evaluated when zod.object...

NPM: Orval: Import-time RCE via schema property name -> computed-property-key injection in the zod client

NPM: Orval: Import-time RCE via schema property name - computed-property-key injection in the zod client vulnerability discovered by ? in WordPress Npm orval versions 8.21.0...

Malicious code in js-array-tokens (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3d54ea75aacb3eed3e1f1739093eb9b0092203fafca42d590bce038530056023 On module load, index.js reconstructs a URL from a char-code array that decodes to https://access-token-delta.vercel.app/, fetches a JSON response, a...

PT-2026-82614

Name of the Vulnerable Software and Affected Versions openssl encrypt versions prior to 1.4.9 Description Insufficient controls during the execution of untrusted third-party plugins allow for arbitrary code execution with the privileges of the user running the software. This occurs because the...

Malicious code in babel-polyfill-plugin-corejs2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 13878d994b01607c379e26646449b7cca95099f9b2eb5be2e1f8e19aeea32eb3 The package advertises itself as a Babel core-js 2 polyfill plugin, but the shipped lib/index.js contains unrelated web3-core-subscriptions boilerpla...

MAL-2026-14371 Malicious code in chai-as-testkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0bf8ab4a811449bd1ba40c637a0eebc0569994d3a3550cf7156c36192abcec31 The package is published as 'chai-as-testkit' with a description referencing vulnerability management, but the tarball ships pino's README, docs/,...

CVE-2026-72717 Orval: Import-time RCE via schema default -> zod module-level template literal

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a $... expression or backtick in a schema default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permits...

CVE-2026-72717 Orval: Import-time RCE via schema default -> zod module-level template literal

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a $... expression or backtick in a schema default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permits...

CVE-2026-72717

CVE-2026-72717 is a critical (CVSS 4.0: 9.3 ) import-time remote code execution vulnerability in Orval , a tool that generates type-safe TypeScript clients from OpenAPI/Swagger specifications. The root cause is in packages/zod/src/index.ts, function formatDefaultValue: a ${...} expression or back...

CVE-2026-71868 Orval: Import-time RCE via enum-typed default -> zod module-level template literal

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a $... expression or backtick in an enum default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permits...

CVE-2026-71868

Orval (a TypeScript client generator from OpenAPI/Swagger specs) is vulnerable to import-time remote code execution prior to version 8.21.0 . The root cause is in packages/zod/src/index.ts function formatDefaultValue: a ${...} expression or backtick in an enum default value is emitted into a modu...

CVE-2026-71865 Orval: Import-time RCE via query parameter name -> computed-property-key injection in the zod cli

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a double quote in a query parameter name is emitted into the generated request-validation zod.object... schema without safe encoding. This permits attacker-controlled...

CVE-2026-71865

Orval (a TypeScript client generator for OpenAPI/Swagger specs) is vulnerable to import-time remote code execution prior to version 8.21.0 . A double quote in a query parameter name is emitted into the generated zod.object({...}) schema without safe encoding, enabling computed-property-key inject...

CVE-2026-71865 Orval: Import-time RCE via query parameter name -> computed-property-key injection in the zod cli

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a double quote in a query parameter name is emitted into the generated request-validation zod.object... schema without safe encoding. This permits attacker-controlled...

CVE-2026-71865 Orval: Import-time RCE via query parameter name -> computed-property-key injection in the zod cli

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a double quote in a query parameter name is emitted into the generated request-validation zod.object... schema without safe encoding. This permits attacker-controlled...

CVE-2026-71869 Orval: Import-time RCE via array-items default -> zod module-level template literal

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a $... expression or backtick in an array item default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permits...

CVE-2026-71869

Orval (a TypeScript client generator from OpenAPI/Swagger specs) is vulnerable to import-time remote code execution prior to version 8.21.0 . The root cause is in the formatDefaultValue function (packages/zod/src/index.ts): a ${...} expression or backtick in an array item default value is emitted...

CVE-2026-71864 Orval: Import-time RCE via header parameter name -> computed-property-key injection in the zod client

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a double quote in a header parameter name is emitted into the generated request-validation zod.object... schema without safe encoding. This permits attacker-controlled...