@testurio/cli (>=0.6.3, <=0.7.3) potentially affected by CVE-2026-71868 via orval (8.5.3)

orval NPM version 8.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on orval and may be impacted: - @testurio/cli =0.6.3, =0.7.3 Source cves: CVE-2026-71868 Source advisory: OSV:GHSA-3575-W9FC-C2J6...

Orval: Import-time RCE via query parameter name -> computed-property-key injection in the zod cli

Summary orval's zod client emits each query parameter name as a double-quoted key in the generated zod.object... request-validation schema WITHOUT escaping the double quote. A " in the query parameter name closes the key and lands in object-literal context, where an injected computed property key...

@testurio/cli (>=0.6.3, <=0.7.3) potentially affected by CVE-2026-71865 via orval (8.5.3)

orval NPM version 8.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on orval and may be impacted: - @testurio/cli =0.6.3, =0.7.3 Source cves: CVE-2026-71865 Source advisory: OSV:GHSA-653Q-5476-X79G...

EUVD-2026-62604

Orval: Import-time RCE via query parameter name - computed-property-key injection in the zod cli...

EUVD-2026-62602

Orval: Import-time RCE via header parameter name - computed-property-key injection in the zod client...

@testurio/cli (>=0.6.3, <=0.7.3) potentially affected by CVE-2026-71864 via orval (8.5.3)

orval NPM version 8.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on orval and may be impacted: - @testurio/cli =0.6.3, =0.7.3 Source cves: CVE-2026-71864 Source advisory: OSV:GHSA-6437-GXHQ-PQV8...

CVE-2026-23947-PoC

演练：CVE-2026-23947 - Orval 任意代码执行 本演练演示了不受信任的 OpenAPI 规范如何利用 x-enumDescriptions 和 x-enumNames 字段，通过 Orval 将任意代码注入到生成的客户端中。 前提条件 Node.js（v20 或 v22） npm 环境搭建 1. 创建一个项目并安装存在漏洞的 orval 版本（例如 7.10.0）： root@kitploit: mkdir orval-poc cd orval-poc npm init -y npm install [email protected] axios 1. 创建...

EUVD-2026-62659

Orval: Generation-time SSRF + remote/local file inclusion via unrestricted $ref...

@testurio/cli (>=0.6.3, <=0.7.3) potentially affected by CVE-2026-62680 via orval (8.5.3)

orval NPM version 8.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on orval and may be impacted: - @testurio/cli =0.6.3, =0.7.3 Source cves: CVE-2026-62680 Source advisory: OSV:GHSA-CXQ5-97V7-87J8...

@testurio/cli (>=0.6.3, <=0.7.3) potentially affected by CVE-2026-72716 via orval (8.5.3)

orval NPM version 8.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on orval and may be impacted: - @testurio/cli =0.6.3, =0.7.3 Source cves: CVE-2026-72716 Source advisory: OSV:GHSA-P4CG-3328-RVFG...

EUVD-2026-62600

Orval: Import-time RCE via query-parameter default - zod module-level template literal...

EUVD-2026-62596

Orval: Import-time RCE via schema property name - computed-property-key injection in the zod client...

@testurio/cli (>=0.6.3, <=0.7.3) potentially affected by CVE-2026-71866 via orval (8.5.3)

orval NPM version 8.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on orval and may be impacted: - @testurio/cli =0.6.3, =0.7.3 Source cves: CVE-2026-71866 Source advisory: OSV:GHSA-6MR6-JVCR-2F25...

CVE-2026-22785

Tutorial de reproducción de CVE-2026-22785 Resumen de la vulnerabilidad CVE : CVE-2026-22785 Impacto : orval = 7.18.0 CVSS : 9.3 CRÍTICO Tipo : Inyección de código Principio de la vulnerabilidad orval 7.18.0, al generar código de servidor MCP, concatena directamente el campo summary de la...

CVE-2026-72717

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a $... expression or backtick in a schema default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permits...

CVE-2026-71867

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a single quote in a schema property name is emitted into single-quoted object keys in generated MSW mock factories without safe encoding. This permits attacker-controlled...

CVE-2026-71868

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a $... expression or backtick in an enum default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permits...

CVE-2026-71869

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a $... expression or backtick in an array item default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permits...

CVE-2026-71871

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a $... expression or backtick in a header parameter default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permi...

CVE-2026-71864

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a double quote in a header parameter name is emitted into the generated request-validation zod.object... schema without safe encoding. This permits attacker-controlled...