CVE-2026-96757 orval before 8.29.0 Code Injection via unescaped OpenAPI media-type

orval before 8.29.0 fails to escape OpenAPI media-type keys when emitting them into single-quoted Content-Type string literals in generated code. Attackers can inject JavaScript through crafted media-type keys in OpenAPI specifications that executes when generated fetch operations or mock resolve...

CVE-2026-96757

The orval library, in versions before 8.29.0 , is vulnerable to a code injection flaw due to the failure to escape OpenAPI media-type keys when emitting them into single-quoted Content-Type string literals in generated code. An attacker can exploit this by providing a crafted media-type key in an...