OR
Product
orval
22
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 20High 2Medium 0Low 0
Watch
Add orval to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-96759 | 9.8 | Sep 23 | orval before 8.29.0 Code Injection via operationId Affected: before 8.29.0 |
| CVE-2026-96758 | 9.8 | Sep 23 | orval @orval/core before 8.28.0 Code Injection via Form-Data Affected: before 8.28.0 |
| CVE-2026-96757 | 9.8 | Sep 23 | orval before 8.29.0 Code Injection via unescaped OpenAPI media-type Affected: 6.7.1 before 8.29.0 |
| CVE-2026-96755 | 9.8 | Sep 23 | orval @orval/effect 8.14.0 through 8.28.1 Code Injection Affected: 8.14.0 before 8.29.0 |
| CVE-2026-96754 | 9.8 | Sep 23 | orval @orval/hono before 8.29.0 Code Injection via OpenAPI Path Affected: before 8.29.0 |
| CVE-2026-25141 | 9.8 | Jan 30 | Orval has a code injection via unsanitized x-enum-descriptions uing JS comments Affected: >= 7.19.0, < 7.21.0; >= 8.0.0, < 8.2.0 |
| CVE-2026-24132 | 9.8 | Jan 22 | Orval Mock Generation Code Injection via const Affected: < 7.20.0; >= 8.0.0-rc.0, < 8.0.3 |
| CVE-2026-23947 | 9.8 | Jan 20 | Orval MCP client is vulnerable to code injection via unsanitized x-enum-descriptions in enum generation Affected: >= 8.0.0-rc.0, < 8.0.2; < 7.19.0 |
| CVE-2026-22785 | 9.8 | Jan 12 | orval MCP client is vulnerable to a code injection attack. Affected: < 7.18.0 |
| CVE-2026-62682 | 9.3 | Aug 19 | Orval: RCE via servers[].url -> unescaped request-URL template literal (with getBaseUrlFromSpecification) Affected: < 8.21.0 |
| CVE-2026-72717 | 9.3 | Aug 19 | Orval: Import-time RCE via schema default -> zod module-level template literal Affected: < 8.21.0 |
| CVE-2026-71867 | 9.3 | Aug 19 | Orval: RCE via schema property name -> computed-property-key injection in the MSW mock generator Affected: < 8.21.0 |
| CVE-2026-71868 | 9.3 | Aug 19 | Orval: Import-time RCE via enum-typed default -> zod module-level template literal Affected: < 8.21.0 |
| CVE-2026-71865 | 9.3 | Aug 19 | Orval: Import-time RCE via query parameter name -> computed-property-key injection in the zod cli Affected: < 8.21.0 |
| CVE-2026-71869 | 9.3 | Aug 19 | Orval: Import-time RCE via array-items default -> zod module-level template literal Affected: < 8.21.0 |
| CVE-2026-71864 | 9.3 | Aug 19 | Orval: Import-time RCE via header parameter name -> computed-property-key injection in the zod client Affected: < 8.21.0 |
| CVE-2026-71871 | 9.3 | Aug 19 | Orval: Import-time RCE via header-parameter default -> zod module-level template literal Affected: < 8.21.0 |
| CVE-2026-72716 | 9.3 | Aug 19 | Orval: Import-time RCE via query-parameter default -> zod module-level template literal Affected: < 8.21.0 |
| CVE-2026-62681 | 9.3 | Aug 19 | Orval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout) Affected: < 8.21.0 |
| CVE-2026-71866 | 9.3 | Aug 19 | Orval: Import-time RCE via schema property name -> computed-property-key injection in the zod client Affected: < 8.21.0 |
| CVE-2026-96756 | 8.1 | Sep 23 | orval before 8.30.0 Code Injection via Factory Generation Affected: before 8.30.0 |
| CVE-2026-62680 | 7.1 | Aug 19 | Orval: Generation-time SSRF + remote/local file inclusion via unrestricted $ref Affected: < 8.22.0 |
Showing 22