EUVD-2026-57408

SiYuan: Second-order SSTI to arbitrary SQL via attribute-view template column queryBlocks: malicious imported package executes SQL on victim kernel...

GHSA-X67C-8PWR-M8G3 SiYuan: Second-order SSTI to arbitrary SQL via attribute-view template column (queryBlocks): malicious imported package executes SQL on victim kernel

CVE: This vulnerability corresponds to CVE-2026-72807. Summary Attribute-view AV template columns are live-evaluated on every render and expose the queryBlocks template function, which runs raw SQL on the read-write database handle SelectBlocksRawStmt, using ?→argument string substitution rather...

Orval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout)

Summary Orval emits the OpenAPI path into the generated request URL as a TEMPLATE LITERAL /users/... without escaping the backtick character. A path containing a backtick closes the template literal and injects a concatenation expression that is evaluated when the generated URL/request/key functi...

EUVD-2026-62599

Orval: RCE via OpenAPI path - unescaped request-URL template literal backtick breakout...

NPM: Orval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout)

NPM: Orval: RCE via OpenAPI path - unescaped request-URL template literal backtick breakout vulnerability discovered by ? in WordPress Npm orval versions 8.21.0...

GHSA-FG9P-MRXR-HVQ7 Orval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout)

Summary Orval emits the OpenAPI path into the generated request URL as a TEMPLATE LITERAL /users/... without escaping the backtick character. A path containing a backtick closes the template literal and injects a concatenation expression that is evaluated when the generated URL/request/key functi...

CVE-2026-78593

An insufficiently validated configuration field in Kibana's Cribl integration allows an authenticated user holding Kibana Fleet management privileges to inject attacker-controlled expressions into a server-side script template, resulting in an Elasticsearch ingest pipeline being written beyond th...

NPM: Orval: RCE via servers[].url -> unescaped request-URL template literal (with getBaseUrlFromSpecification)

NPM: Orval: RCE via servers.url - unescaped request-URL template literal with getBaseUrlFromSpecification vulnerability discovered by ? in WordPress Npm orval versions 8.21.0...

EUVD-2026-62658

Orval: RCE via servers.url - unescaped request-URL template literal with getBaseUrlFromSpecification...

Orval: RCE via servers[].url -> unescaped request-URL template literal (with getBaseUrlFromSpecification)

Summary When Orval is configured with output.baseUrl.getBaseUrlFromSpecification: true, it bakes the spec's servers0.url into the generated request URL as a template literal without escaping the backtick. A server URL containing a backtick closes the template literal and injects a concatenation...

GHSA-88F2-FPV8-89Q2 Orval: RCE via servers[].url -> unescaped request-URL template literal (with getBaseUrlFromSpecification)

Summary When Orval is configured with output.baseUrl.getBaseUrlFromSpecification: true, it bakes the spec's servers0.url into the generated request URL as a template literal without escaping the backtick. A server URL containing a backtick closes the template literal and injects a concatenation...

Orval: Import-time RCE via schema default -> zod module-level template literal

Summary Orval's zod schema generation emits a schema's default value as a module-level template literal export const …Default = ; without escaping $ or the backtick. A default of the form v$w injects a live JavaScript expression that is evaluated when the generated zod schema module is imported,...

EUVD-2026-62657

Orval: Import-time RCE via schema default - zod module-level template literal...

NPM: Orval: Import-time RCE via schema default -> zod module-level template literal

NPM: Orval: Import-time RCE via schema default - zod module-level template literal vulnerability discovered by ? in WordPress Npm orval versions 8.21.0...

GHSA-W727-8J6C-2RJ4 Orval: Import-time RCE via schema default -> zod module-level template literal

Summary Orval's zod schema generation emits a schema's default value as a module-level template literal export const …Default = ; without escaping $ or the backtick. A default of the form v$w injects a live JavaScript expression that is evaluated when the generated zod schema module is imported,...

Orval: Import-time RCE via array-items default -> zod module-level template literal

Summary Orval's zod schema generation emits the array-items default value as a module-level template literal export const …Default = ; without escaping $ or the backtick. A default of the form v$w injects a live JavaScript expression evaluated when the generated zod schema module is imported,...

EUVD-2026-62603

Orval: Import-time RCE via array-items default - zod module-level template literal...

NPM: Orval: Import-time RCE via array-items default -> zod module-level template literal

NPM: Orval: Import-time RCE via array-items default - zod module-level template literal vulnerability discovered by ? in WordPress Npm orval versions 8.21.0...

GHSA-2H9G-J24R-H63G Orval: Import-time RCE via array-items default -> zod module-level template literal

Summary Orval's zod schema generation emits the array-items default value as a module-level template literal export const …Default = ; without escaping $ or the backtick. A default of the form v$w injects a live JavaScript expression evaluated when the generated zod schema module is imported,...

CVE-2026-78593 Improper Control of Generation of Code in Kibana Leading to Privilege Escalation

An insufficiently validated configuration field in Kibana's Cribl integration allows an authenticated user holding Kibana Fleet management privileges to inject attacker-controlled expressions into a server-side script template, resulting in an Elasticsearch ingest pipeline being written beyond th...