Act nowDisclosed

Advisory · CVE-2026-96755

Critical code injection in orval's Effect generator

Schema defaults containing ${...} syntax are converted into template literals by the @orval/effect generator, executing injected JavaScript at module scope when the generated code is built or imported.

Advisory published September 23, 2026Independent summary
Vendor
orval-labs
Product
orval
Identifier / CWE
CVE-2026-96755
CWE-94
Action timing
Immediate
ELI5

Explain it like I’m five

orval copies default values from an API blueprint straight into the code it writes, wrapping them in a kind of text box that the computer treats as live commands. An attacker hides commands inside a default value, and they run the moment the code is loaded.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Poisoned spec

    An attacker crafts an OpenAPI schema with a default value containing ${...} JavaScript expression syntax.

  2. 02Code generation

    The @orval/effect generator converts the schema default into a template literal, placing the expression into executable position.

  3. 03Build or import

    The generated module is built or imported by a developer's project.

  4. 04Execution

    The injected expression evaluates at module scope with the developer's privileges.

What happened

orval versions 8.14.0 through 8.28.1 contain a code injection flaw in the @orval/effect generator. Schema defaults are converted into template literals without neutralizing expression syntax, so a default value containing ${…} becomes live JavaScript that executes at module scope when the generated code is built or imported.

The advisory reports versions 8.14.0 through 8.28.1 as affected and 8.29.0 as fixed, with a critical CVSS 9.8 rating. This is the second of three same-day orval generator injection flaws, alongside CVE-2026-96754 and CVE-2026-96759.

What to do

  1. Inventory projects using the @orval/effect generator and confirm the orval version.
  2. Upgrade affected projects to orval 8.29.0 or later using the project release guidance.
  3. Treat OpenAPI specifications from untrusted or semi-trusted sources as hostile input until upgraded.
  4. Search generated code and schema files for ${ sequences inside default values.
  5. Check build and developer machines that processed affected specs for signs of follow-on activity.

Management note

Three critical injection flaws in one generator release train is a pattern, not a coincidence: it points to output encoding being absent by design across the generators. Upgrade all three at once and reconsider how much trust generated code gets before it is reviewed.