High severity · published Sep 23, 2026
CVE-2026-96756
orval before 8.30.0 Code Injection via Factory Generation
8.1
CVSS
0.9%
EPSS
No
On KEV
Description
orval versions before 8.30.0 contain a code injection vulnerability in the @orval/core factory generator that fails to escape date default values in new Date() calls. Attackers can inject arbitrary expressions through apostrophes in OpenAPI schema defaults to execute code with the privileges of the consumer process when factoryMethods and useDates options are enabled.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 59% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OR
orval · orval-labs
before 8.30.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-96756
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-96756
github.com
https://github.com/orval-labs/orval
github.com
https://github.com/orval-labs/orval/blob/v8.29.0/packages/core/src/generators/factory.ts#L493
github.com
https://github.com/orval-labs/orval/commit/b9b083576943c683540200eb957feced57dddc1a
github.com
https://github.com/orval-labs/orval/pull/4038
github.com
https://github.com/orval-labs/orval/security/advisories/GHSA-wx66-36r6-v5g7
www.vulncheck.com
https://www.vulncheck.com/advisories/orval-before-8.30.0-code-injection-via-factory-generation
More from orval
9.8
CVE-2026-96759
orval before 8.29.0 Code Injection via operationId
9.8
CVE-2026-96758
orval @orval/core before 8.28.0 Code Injection via Form-Data
9.8
CVE-2026-96757
orval before 8.29.0 Code Injection via unescaped OpenAPI media-type
9.8
CVE-2026-96755
orval @orval/effect 8.14.0 through 8.28.1 Code Injection
9.8
CVE-2026-96754
orval @orval/hono before 8.29.0 Code Injection via OpenAPI Path