CVE-2026-96756

orval versions before 8.30.0 contain a code injection vulnerability in the @orval/core factory generator that fails to escape date default values in new Date() calls. Attackers can inject arbitrary expressions through apostrophes in OpenAPI schema defaults to execute code with the privileges of the consumer process when factoryMethods and useDates options are enabled.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/orval-labs/orval
https://github.com/orval-labs/orval/blob/v8.29.0/packages/core/src/generators/factory.ts#L493
https://github.com/orval-labs/orval/commit/b9b083576943c683540200eb957feced57dddc1a
https://github.com/orval-labs/orval/pull/4038
https://github.com/orval-labs/orval/security/advisories/GHSA-wx66-36r6-v5g7
https://www.vulncheck.com/advisories/orval-before-8.30.0-code-injection-via-factory-generation

Configurations

No configuration.

History

23 Sep 2026, 17:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-09-23 17:17

Updated : 2026-09-23 20:17

NVD link : CVE-2026-96756

Mitre link : CVE-2026-96756

CVE.ORG link : CVE-2026-96756

JSON object : View

Products Affected

No product.

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

{"id": "CVE-2026-96756", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-96756", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-09-23T18:11:23.190187Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.2}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.2, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "orval-labs", "product": "orval", "versions": [{"status": "affected", "version": "0", "lessThan": "8.30.0", "versionType": "semver"}, {"status": "unaffected", "version": "8.30.0", "versionType": "semver"}], "packageURL": "pkg:npm/orval", "defaultStatus": "unaffected"}]}], "published": "2026-09-23T17:17:24.767", "references": [{"url": "https://github.com/orval-labs/orval", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/orval-labs/orval/blob/v8.29.0/packages/core/src/generators/factory.ts#L493", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/orval-labs/orval/commit/b9b083576943c683540200eb957feced57dddc1a", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/orval-labs/orval/pull/4038", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/orval-labs/orval/security/advisories/GHSA-wx66-36r6-v5g7", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/orval-before-8.30.0-code-injection-via-factory-generation", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "orval versions before 8.30.0 contain a code injection vulnerability in the @orval/core factory generator that fails to escape date default values in new Date() calls. Attackers can inject arbitrary expressions through apostrophes in OpenAPI schema defaults to execute code with the privileges of the consumer process when factoryMethods and useDates options are enabled."}], "lastModified": "2026-09-23T20:17:27.057", "sourceIdentifier": "disclosure@vulncheck.com"}