Critical severity · published Sep 23, 2026
CVE-2026-96759
orval before 8.29.0 Code Injection via operationId
9.8
CVSS
0.5%
EPSS
No
On KEV
Description
orval before 8.29.0 fails to escape the operationId parameter when emitting it into generated TanStack Query mutator options metadata objects. Attackers can inject arbitrary JavaScript code through a crafted operationId in an OpenAPI specification that executes when generated hooks are called.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 45% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OR
orval · orval-labs
before 8.29.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-96759
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-96759
vendor-advisory
https://github.com/orval-labs/orval/security/advisories/GHSA-vv88-cm6j-665j
patch
https://github.com/orval-labs/orval/pull/4008
patch
https://github.com/orval-labs/orval/commit/b28c53f3e0c06190e0f6ea136737e6316432448f
technical-description
https://github.com/orval-labs/orval/blob/v8.28.1/packages/query/src/query-generator.ts#L784
product
https://github.com/orval-labs/orval
third-party-advisory
https://www.vulncheck.com/advisories/orval-before-8.29.0-code-injection-via-operationid
More from orval
9.8
CVE-2026-96758
orval @orval/core before 8.28.0 Code Injection via Form-Data
9.8
CVE-2026-96757
orval before 8.29.0 Code Injection via unescaped OpenAPI media-type
9.8
CVE-2026-96755
orval @orval/effect 8.14.0 through 8.28.1 Code Injection
9.8
CVE-2026-96754
orval @orval/hono before 8.29.0 Code Injection via OpenAPI Path
9.8
CVE-2026-25141
Orval has a code injection via unsanitized x-enum-descriptions uing JS comments