18349 matches found
EUVD-2026-62658
Orval: RCE via servers.url - unescaped request-URL template literal with getBaseUrlFromSpecification...
Orval: RCE via servers[].url -> unescaped request-URL template literal (with getBaseUrlFromSpecification)
Summary When Orval is configured with output.baseUrl.getBaseUrlFromSpecification: true, it bakes the spec's servers0.url into the generated request URL as a template literal without escaping the backtick. A server URL containing a backtick closes the template literal and injects a concatenation...
NPM: Orval: RCE via servers[].url -> unescaped request-URL template literal (with getBaseUrlFromSpecification)
NPM: Orval: RCE via servers.url - unescaped request-URL template literal with getBaseUrlFromSpecification vulnerability discovered by ? in WordPress Npm orval versions 8.21.0...
GHSA-88F2-FPV8-89Q2 Orval: RCE via servers[].url -> unescaped request-URL template literal (with getBaseUrlFromSpecification)
Summary When Orval is configured with output.baseUrl.getBaseUrlFromSpecification: true, it bakes the spec's servers0.url into the generated request URL as a template literal without escaping the backtick. A server URL containing a backtick closes the template literal and injects a concatenation...
NPM: Orval: Import-time RCE via schema default -> zod module-level template literal
NPM: Orval: Import-time RCE via schema default - zod module-level template literal vulnerability discovered by ? in WordPress Npm orval versions 8.21.0...
EUVD-2026-62657
Orval: Import-time RCE via schema default - zod module-level template literal...
Orval: Import-time RCE via schema default -> zod module-level template literal
Summary Orval's zod schema generation emits a schema's default value as a module-level template literal export const …Default = ; without escaping $ or the backtick. A default of the form v$w injects a live JavaScript expression that is evaluated when the generated zod schema module is imported,...
GHSA-W727-8J6C-2RJ4 Orval: Import-time RCE via schema default -> zod module-level template literal
Summary Orval's zod schema generation emits a schema's default value as a module-level template literal export const …Default = ; without escaping $ or the backtick. A default of the form v$w injects a live JavaScript expression that is evaluated when the generated zod schema module is imported,...
Orval: Import-time RCE via array-items default -> zod module-level template literal
Summary Orval's zod schema generation emits the array-items default value as a module-level template literal export const …Default = ; without escaping $ or the backtick. A default of the form v$w injects a live JavaScript expression evaluated when the generated zod schema module is imported,...
GHSA-2H9G-J24R-H63G Orval: Import-time RCE via array-items default -> zod module-level template literal
Summary Orval's zod schema generation emits the array-items default value as a module-level template literal export const …Default = ; without escaping $ or the backtick. A default of the form v$w injects a live JavaScript expression evaluated when the generated zod schema module is imported,...
EUVD-2026-62603
Orval: Import-time RCE via array-items default - zod module-level template literal...
NPM: Orval: Import-time RCE via array-items default -> zod module-level template literal
NPM: Orval: Import-time RCE via array-items default - zod module-level template literal vulnerability discovered by ? in WordPress Npm orval versions 8.21.0...
CVE-2026-78593 Improper Control of Generation of Code in Kibana Leading to Privilege Escalation
An insufficiently validated configuration field in Kibana's Cribl integration allows an authenticated user holding Kibana Fleet management privileges to inject attacker-controlled expressions into a server-side script template, resulting in an Elasticsearch ingest pipeline being written beyond th...
EUVD-2026-70658
An insufficiently validated configuration field in Kibana's Cribl integration allows an authenticated user holding Kibana Fleet management privileges to inject attacker-controlled expressions into a server-side script template, resulting in an Elasticsearch ingest pipeline being written beyond th...
CVE-2026-78593
Kibana 's Cribl integration contains an insufficiently validated configuration field that allows an authenticated user with Kibana Fleet management privileges to inject attacker-controlled expressions into a server-side script template. This results in an Elasticsearch ingest pipeline being writt...
CVE-2026-61556
creationtimestamp| type| source ---|---|--- 2026-09-03 18:35:04+00:00| published-proof-of-concept| https://github.com/harttle/liquidjs/security/advisories/GHSA-m7fp-h3p4-hr49...
io.quarkus:quarkus-qute: quarkus-qute:Server-Side Template Injection (SSTI) vulnerability in ReflectionValueResolver of the Quarkus Qute template engine
A flaw was found in the Qute template engine, which is used by Quarkus to generate dynamic content like HTML pages or emails. The issue exists in the component responsible for looking up data values ReflectionValueResolver, which fails to properly block access to sensitive Java internal functions...
NPM: Orval: Import-time RCE via header-parameter default -> zod module-level template literal
NPM: Orval: Import-time RCE via header-parameter default - zod module-level template literal vulnerability discovered by ? in WordPress Npm orval versions 8.21.0...
Orval: Import-time RCE via header-parameter default -> zod module-level template literal
Summary Orval's zod schema generation emits the header-parameter default value as a module-level template literal export const Default = ; without escaping $ or the backtick. A default of the form v$w injects a live JavaScript expression evaluated when the generated zod schema module is imported,...