109 matches found
EUVD-2026-62599
Orval: RCE via OpenAPI path - unescaped request-URL template literal backtick breakout...
NPM: Orval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout)
NPM: Orval: RCE via OpenAPI path - unescaped request-URL template literal backtick breakout vulnerability discovered by ? in WordPress Npm orval versions 8.21.0...
Orval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout)
Summary Orval emits the OpenAPI path into the generated request URL as a TEMPLATE LITERAL /users/... without escaping the backtick character. A path containing a backtick closes the template literal and injects a concatenation expression that is evaluated when the generated URL/request/key functi...
GHSA-FG9P-MRXR-HVQ7 Orval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout)
Summary Orval emits the OpenAPI path into the generated request URL as a TEMPLATE LITERAL /users/... without escaping the backtick character. A path containing a backtick closes the template literal and injects a concatenation expression that is evaluated when the generated URL/request/key functi...
NPM: Orval: RCE via servers[].url -> unescaped request-URL template literal (with getBaseUrlFromSpecification)
NPM: Orval: RCE via servers.url - unescaped request-URL template literal with getBaseUrlFromSpecification vulnerability discovered by ? in WordPress Npm orval versions 8.21.0...
EUVD-2026-62658
Orval: RCE via servers.url - unescaped request-URL template literal with getBaseUrlFromSpecification...
Orval: RCE via servers[].url -> unescaped request-URL template literal (with getBaseUrlFromSpecification)
Summary When Orval is configured with output.baseUrl.getBaseUrlFromSpecification: true, it bakes the spec's servers0.url into the generated request URL as a template literal without escaping the backtick. A server URL containing a backtick closes the template literal and injects a concatenation...
GHSA-88F2-FPV8-89Q2 Orval: RCE via servers[].url -> unescaped request-URL template literal (with getBaseUrlFromSpecification)
Summary When Orval is configured with output.baseUrl.getBaseUrlFromSpecification: true, it bakes the spec's servers0.url into the generated request URL as a template literal without escaping the backtick. A server URL containing a backtick closes the template literal and injects a concatenation...
NPM: Orval: Import-time RCE via schema default -> zod module-level template literal
NPM: Orval: Import-time RCE via schema default - zod module-level template literal vulnerability discovered by ? in WordPress Npm orval versions 8.21.0...
EUVD-2026-62657
Orval: Import-time RCE via schema default - zod module-level template literal...
GHSA-W727-8J6C-2RJ4 Orval: Import-time RCE via schema default -> zod module-level template literal
Summary Orval's zod schema generation emits a schema's default value as a module-level template literal export const …Default = ; without escaping $ or the backtick. A default of the form v$w injects a live JavaScript expression that is evaluated when the generated zod schema module is imported,...
Orval: Import-time RCE via schema default -> zod module-level template literal
Summary Orval's zod schema generation emits a schema's default value as a module-level template literal export const …Default = ; without escaping $ or the backtick. A default of the form v$w injects a live JavaScript expression that is evaluated when the generated zod schema module is imported,...
NPM: Orval: Import-time RCE via array-items default -> zod module-level template literal
NPM: Orval: Import-time RCE via array-items default - zod module-level template literal vulnerability discovered by ? in WordPress Npm orval versions 8.21.0...
GHSA-2H9G-J24R-H63G Orval: Import-time RCE via array-items default -> zod module-level template literal
Summary Orval's zod schema generation emits the array-items default value as a module-level template literal export const …Default = ; without escaping $ or the backtick. A default of the form v$w injects a live JavaScript expression evaluated when the generated zod schema module is imported,...
Orval: Import-time RCE via array-items default -> zod module-level template literal
Summary Orval's zod schema generation emits the array-items default value as a module-level template literal export const …Default = ; without escaping $ or the backtick. A default of the form v$w injects a live JavaScript expression evaluated when the generated zod schema module is imported,...
NPM: Orval: Import-time RCE via header-parameter default -> zod module-level template literal
NPM: Orval: Import-time RCE via header-parameter default - zod module-level template literal vulnerability discovered by ? in WordPress Npm orval versions 8.21.0...
GHSA-8J6P-R8JG-MXQH Orval: Import-time RCE via header-parameter default -> zod module-level template literal
Summary Orval's zod schema generation emits the header-parameter default value as a module-level template literal export const Default = ; without escaping $ or the backtick. A default of the form v$w injects a live JavaScript expression evaluated when the generated zod schema module is imported,...
EUVD-2026-62601
Orval: Import-time RCE via header-parameter default - zod module-level template literal...
Orval: Import-time RCE via header-parameter default -> zod module-level template literal
Summary Orval's zod schema generation emits the header-parameter default value as a module-level template literal export const Default = ; without escaping $ or the backtick. A default of the form v$w injects a live JavaScript expression evaluated when the generated zod schema module is imported,...