CVE-2026-62680

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.22.0, Orval resolves remote and local external $ref values without an allowlist or confinement to the input directory. Processing an attacker-controlled OpenAPI description can cau...

CVE-2026-71867

Orval versions prior to 8.21.0 emit unsanitized single quotes from OpenAPI schema property names into single-quoted object keys in generated MSW mock factories (packages/core/src/getters/keys.ts), enabling attacker-controlled JavaScript evaluation and RCE in developer, CI, test, or application en...

CVE-2026-71866 Orval: Import-time RCE via schema property name -> computed-property-key injection in the zod client

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. From version 8.19.0 until 8.21.0, a double quote in a schema property name is emitted into the generated zod.object... schema without safe encoding. This permits attacker-controlled JavaScrip...

PT-2026-78551

Name of the Vulnerable Software and Affected Versions Orval versions prior to 8.21.0 Description Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. A flaw exists where a single quote in a schema property name is emitted into single-quoted...

CVE-2021-47715

Hasura GraphQL Engine 1.3.3 is exposed to a server-side request forgery via the add_remote_schema endpoint. The underlying issue allows injection of arbitrary remote schema URLs by crafting POST requests to /v1/query, potentially enabling access to internal network resources. Affected component: ...

CVE-2021-47715 Hasura GraphQL 1.3.3 Server-Side Request Forgery via Remote Schema Injection

Hasura GraphQL 1.3.3 contains a server-side request forgery vulnerability that allows attackers to inject arbitrary remote schema URLs through the addremoteschema endpoint. Attackers can exploit the vulnerability by sending crafted POST requests to the /v1/query endpoint with malicious URL...

CVE-2021-47715 Hasura GraphQL 1.3.3 Server-Side Request Forgery via Remote Schema Injection

Hasura GraphQL 1.3.3 contains a server-side request forgery vulnerability that allows attackers to inject arbitrary remote schema URLs through the addremoteschema endpoint. Attackers can exploit the vulnerability by sending crafted POST requests to the /v1/query endpoint with malicious URL...

CVE-2024-53848 check-jsonschema default caching for remote schemas allows for cache confusion

check-jsonschema is a CLI and set of pre-commit hooks for jsonschema validation. The default cache strategy uses the basename of a remote schema as the name of the file in the cache, e.g. https://example.org/schema.json will be stored as schema.json. This naming allows for conflicts. If an attack...

Cloudflare Public Bug Bounty: YAML schema injection risk in Swagger UI via schema_url parameter at developers.cloudflare.com

Vulnerability description not provided...

XSS vulnerability in GraphQL Playground from untrusted schemas

GraphQL Playground introspection schema template injection attack: Advisory Statement This is a security advisory for an XSS vulnerability in graphql-playground. A similar vulnerability affects graphiql, the package from which graphql-playground was forked. There is a corresponding graphiql...

Remote Code Execution (RCE)

jsen is vulnerable to remote code execution RCE. Lack of sanitization of the required field of the schema allows an attacker to inject and execute malicious javascript code via Function.apply;...