Vulnerability · Published Sep 23, 2026 · Assigned by VulnCheck
CVE-2026-96759orval before 8.29.0 Code Injection via operationId
Critical 9.8
In plain English
A critical-severity code injection in orval from orval-labs. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)0.5%top 54.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
orval before 8.29.0 fails to escape the operationId parameter when emitting it into generated TanStack Query mutator options metadata objects. Attackers can inject arbitrary JavaScript code through a crafted operationId in an OpenAPI specification that executes when generated hooks are called.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| orval-labs | orval | 0 – before 8.29.0 |
Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- GitHub Security Advisory (GHSA-vv88-cm6j-665j) vendor-advisory
- https://github.com/orval-labs/orval/pull/4008 patch, issue-tracking
- https://github.com/orval-labs/orval/commit/b28c53f3e0c06190e0f6ea136737e6316432448f patch
- https://github.com/orval-labs/orval/blob/v8.28.1/packages/query/src/query-generator.ts#L784 technical-description
- https://github.com/orval-labs/orval product
- VulnCheck Advisory: orval before 8.29.0 Code Injection via operationId third-party-advisory