Act nowDisclosed

Advisory · CVE-2026-96759

Critical code injection through orval operationId values

orval emits the operationId into generated TanStack Query mutator metadata without escaping, so a crafted operationId in an OpenAPI spec injects JavaScript that runs when the generated hooks are called.

Advisory published September 23, 2026Independent summary
Vendor
orval-labs
Product
orval
Identifier / CWE
CVE-2026-96759
CWE-94
Action timing
Immediate
ELI5

Explain it like I’m five

orval labels every API action with a name taken from the blueprint, then stamps that name into the code. If the name contains hidden computer instructions, they get stamped in too and run whenever the app calls that API action.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Poisoned spec

    An attacker crafts an OpenAPI specification whose operationId contains JavaScript.

  2. 02Code generation

    orval emits the operationId into generated TanStack Query mutator options metadata without escaping.

  3. 03Hook call

    A developer's application calls the generated hook, which references the injected value.

  4. 04Execution

    The injected JavaScript executes in the context of the calling application.

What happened

orval versions before 8.29.0 fail to escape the operationId parameter when emitting it into generated TanStack Query mutator options metadata objects. A crafted operationId in an OpenAPI specification injects arbitrary JavaScript that executes when the generated hooks are called, which means the payload can detonate at runtime in production applications, not just on developer machines.

The advisory reports releases before 8.29.0 as affected and 8.29.0 as fixed, rated critical at CVSS 9.8. It completes a same-day trio of orval generator injection flaws with CVE-2026-96754 and CVE-2026-96755.

What to do

  1. Inventory projects that generate TanStack Query clients with orval and confirm the orval version.
  2. Upgrade affected projects to orval 8.29.0 or later using the project release guidance.
  3. Regenerate clients from specifications and review operationId values for anything that is not a plain identifier.
  4. Treat OpenAPI specifications from untrusted or semi-trusted sources as hostile input until upgraded.
  5. Review application logs and deployed frontends that consumed generated hooks from suspect specs.

Management note

This one is the sharpest of the three because the payload fires when end users trigger the generated hooks, not just at build time. Prioritize regenerating and redeploying any client built from a spec you did not author yourself.