Oorval-labs

Products

Exploited and recent CVEs

• CVE-2026-96759 Critical 9.8 orval before 8.29.0 Code Injection via operationId 0.5%
• CVE-2026-96758 Critical 9.8 orval @orval/core before 8.28.0 Code Injection via Form-Data 0.8%
• CVE-2026-96757 Critical 9.8 orval before 8.29.0 Code Injection via unescaped OpenAPI media-type 0.8%
• CVE-2026-96756 High 8.1 orval before 8.30.0 Code Injection via Factory Generation 0.9%
• CVE-2026-96755 Critical 9.8 orval @orval/effect 8.14.0 through 8.28.1 Code Injection 0.8%
• CVE-2026-96754 Critical 9.8 orval @orval/hono before 8.29.0 Code Injection via OpenAPI Path 0.5%
• CVE-2026-62680 High 7.1 Orval: Generation-time SSRF + remote/local file inclusion via unrestricted $ref 0.4%
• CVE-2026-62682 Critical 9.3 Orval: RCE via servers[].url -> unescaped request-URL template literal (with getBaseUrlFromSpecification) 0.7%
• CVE-2026-72717 Critical 9.3 Orval: Import-time RCE via schema default -> zod module-level template literal 0.7%
• CVE-2026-71867 Critical 9.3 Orval: RCE via schema property name -> computed-property-key injection in the MSW mock generator 0.7%
• CVE-2026-71868 Critical 9.3 Orval: Import-time RCE via enum-typed default -> zod module-level template literal 0.7%
• CVE-2026-71865 Critical 9.3 Orval: Import-time RCE via query parameter name -> computed-property-key injection in the zod cli 0.7%
• CVE-2026-71869 Critical 9.3 Orval: Import-time RCE via array-items default -> zod module-level template literal 0.7%
• CVE-2026-71864 Critical 9.3 Orval: Import-time RCE via header parameter name -> computed-property-key injection in the zod client 0.7%
• CVE-2026-71871 Critical 9.3 Orval: Import-time RCE via header-parameter default -> zod module-level template literal 0.7%
• CVE-2026-72716 Critical 9.3 Orval: Import-time RCE via query-parameter default -> zod module-level template literal 0.7%
• CVE-2026-62681 Critical 9.3 Orval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout) 0.7%
• CVE-2026-71866 Critical 9.3 Orval: Import-time RCE via schema property name -> computed-property-key injection in the zod client 0.7%
• CVE-2026-25141 Critical 9.3 Orval has a code injection via unsanitized x-enum-descriptions uing JS comments 0.7%
• CVE-2026-24132 High 7.7 Orval Mock Generation Code Injection via const 0.7%
• CVE-2026-23947 Critical 9.3 Orval MCP client is vulnerable to code injection via unsanitized x-enum-descriptions in enum generation 0.8%
• CVE-2026-22785 Critical 9.3 orval MCP client is vulnerable to a code injection attack. 0.8%