Description
orval versions before 8.30.0 contain a code injection vulnerability in the @orval/core factory generator that fails to escape date default values in new Date() calls. Attackers can inject arbitrary expressions through apostrophes in OpenAPI schema defaults to execute code with the privileges of the consumer process when factoryMethods and useDates options are enabled.
Published: 2026-09-23
Score: 9.2 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Update to 8.30.0
AI Analysis

Impact

orval versions prior to 8.30.0 expose a code injection flaw in the @orval/core factory generator when date default values are not escaped. Arbitrary code can be injected through apostrophes in OpenAPI schema defaults, enabling attackers to execute expressions with the privileges of the consumer process when the factoryMethods and useDates options are enabled.

Affected Systems

The vulnerability affects the orval tool from orval-labs, specifically all releases before 8.30.0. Any project that uses orval to generate factories from OpenAPI schemas and has the factoryMethods and useDates options enabled is at risk.

Risk and Exploitability

The CVSS score is 9.2, rating the flaw as critical. Although EPSS data is unavailable and the vulnerability is not listed in the CISA KEV catalog, the high score indicates significant impact. Attackers who can influence the OpenAPI schema default values can run arbitrary code in the context of the application using orval, potentially compromising confidentiality, integrity, and availability.

Generated by OpenCVE AI on September 23, 2026 at 17:38 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade orval to version 8.30.0 or later to apply the official fix.
  • If upgrading immediately is not possible, disable the factoryMethods and useDates options or ensure that any schema defaults containing apostrophes are sanitized to escape the characters before passing them to the factory generator.
  • Apply the patch from commit b9b083576943c683540200eb957feced57dddc1a or merge pull request 4038 to correct the unescaped date default handling.

Generated by OpenCVE AI on September 23, 2026 at 17:38 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 23 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 23 Sep 2026 16:45:00 +0000

Type Values Removed Values Added
Description orval versions before 8.30.0 contain a code injection vulnerability in the @orval/core factory generator that fails to escape date default values in new Date() calls. Attackers can inject arbitrary expressions through apostrophes in OpenAPI schema defaults to execute code with the privileges of the consumer process when factoryMethods and useDates options are enabled.
Title orval before 8.30.0 Code Injection via Factory Generation
First Time appeared Orval
Orval orval
Weaknesses CWE-94
CPEs cpe:2.3:a:orval:orval:*:*:*:*:*:*:*:*
Vendors & Products Orval
Orval orval
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 9.2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Orval Orval
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-09-23T19:44:36.697Z

Reserved: 2026-09-23T15:58:25.631Z

Link: CVE-2026-96756

cve-icon Vulnrichment

Updated: 2026-09-23T18:11:28.991Z

cve-icon NVD

Status : Deferred

Published: 2026-09-23T17:17:24.767

Modified: 2026-09-23T20:17:27.057

Link: CVE-2026-96756

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-23T23:45:10Z

Weaknesses
  • CWE-94

    Improper Control of Generation of Code ('Code Injection')