OR
Vendor
orval-labs
22
CVEs
0
On KEV
0
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-96759 | OR orval orval-labs | 9.8 | Sep 23 | orval before 8.29.0 Code Injection via operationId |
| CVE-2026-96758 | OR orval orval-labs | 9.8 | Sep 23 | orval @orval/core before 8.28.0 Code Injection via Form-Data |
| CVE-2026-96757 | OR orval orval-labs | 9.8 | Sep 23 | orval before 8.29.0 Code Injection via unescaped OpenAPI media-type |
| CVE-2026-96756 | OR orval orval-labs | 8.1 | Sep 23 | orval before 8.30.0 Code Injection via Factory Generation |
| CVE-2026-96755 | OR orval orval-labs | 9.8 | Sep 23 | orval @orval/effect 8.14.0 through 8.28.1 Code Injection |
| CVE-2026-96754 | OR orval orval-labs | 9.8 | Sep 23 | orval @orval/hono before 8.29.0 Code Injection via OpenAPI Path |
| CVE-2026-62680 | OR orval orval-labs | 7.1 | Aug 19 | Orval: Generation-time SSRF + remote/local file inclusion via unrestricted $ref |
| CVE-2026-62682 | OR orval orval-labs | 9.3 | Aug 19 | Orval: RCE via servers[].url -> unescaped request-URL template literal (with getBaseUrlFromSpecification) |
| CVE-2026-72717 | OR orval orval-labs | 9.3 | Aug 19 | Orval: Import-time RCE via schema default -> zod module-level template literal |
| CVE-2026-71867 | OR orval orval-labs | 9.3 | Aug 19 | Orval: RCE via schema property name -> computed-property-key injection in the MSW mock generator |
| CVE-2026-71868 | OR orval orval-labs | 9.3 | Aug 19 | Orval: Import-time RCE via enum-typed default -> zod module-level template literal |
| CVE-2026-71865 | OR orval orval-labs | 9.3 | Aug 19 | Orval: Import-time RCE via query parameter name -> computed-property-key injection in the zod cli |
| CVE-2026-71869 | OR orval orval-labs | 9.3 | Aug 19 | Orval: Import-time RCE via array-items default -> zod module-level template literal |
| CVE-2026-71864 | OR orval orval-labs | 9.3 | Aug 19 | Orval: Import-time RCE via header parameter name -> computed-property-key injection in the zod client |
| CVE-2026-71871 | OR orval orval-labs | 9.3 | Aug 19 | Orval: Import-time RCE via header-parameter default -> zod module-level template literal |
| CVE-2026-72716 | OR orval orval-labs | 9.3 | Aug 19 | Orval: Import-time RCE via query-parameter default -> zod module-level template literal |
| CVE-2026-62681 | OR orval orval-labs | 9.3 | Aug 19 | Orval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout) |
| CVE-2026-71866 | OR orval orval-labs | 9.3 | Aug 19 | Orval: Import-time RCE via schema property name -> computed-property-key injection in the zod client |
| CVE-2026-25141 | OR orval orval-labs | 9.8 | Jan 30 | Orval has a code injection via unsanitized x-enum-descriptions uing JS comments |
| CVE-2026-24132 | OR orval orval-labs | 9.8 | Jan 22 | Orval Mock Generation Code Injection via const |
| CVE-2026-23947 | OR orval orval-labs | 9.8 | Jan 20 | Orval MCP client is vulnerable to code injection via unsanitized x-enum-descriptions in enum generation |
| CVE-2026-22785 | OR orval orval-labs | 9.8 | Jan 12 | orval MCP client is vulnerable to a code injection attack. |