{"cve":"CVE-2026-96755","enrichment":{"affected":[{"configurations":[{"platform":null,"status":"affected","versions":{"scheme":"semver","value":"[8.14.0,8.29.0)"}},{"platform":null,"status":"unaffected","versions":{"scheme":"semver","value":"8.29.0"}}],"enrichment":{"confidence":95.0,"confidence_source":"inferred","scores":[{"score":95.0,"source":"inferred"},{"score":100.0,"source":"matching"}]},"original":{"product":"orval","source":"cna","vendor":"orval-labs"},"product":"orval","vendor":"orval"}],"created":"2026-09-23T18:00:07.945449+00:00","updated":"2026-09-23T18:15:07.018421+00:00","vendors":["orval","orval$PRODUCT$orval"]},"mitre":{"cpes":["cpe:2.3:a:orval:orval:*:*:*:*:*:*:*:*"],"created":"2026-09-23T16:23:52.011000+00:00","description":"orval versions 8.14.0 through 8.28.1 contain a code injection vulnerability in the @orval/effect generator that converts OpenAPI schema defaults into template literals. Attackers can inject arbitrary JavaScript expressions via schema defaults containing ${...} syntax, which are executed at module scope when the generated code is built or imported.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{"score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"cvssV4_0":{"score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}},"mitre_repo_path":"cves/2026/96xxx/CVE-2026-96755.json","references":["https://github.com/orval-labs/orval","https://github.com/orval-labs/orval/blob/v8.28.1/packages/effect/src/index.ts#L298-L302","https://github.com/orval-labs/orval/commit/d346d94a660e50a2f8d0f7c17fee2c4c69d8dc23","https://github.com/orval-labs/orval/pull/3995","https://github.com/orval-labs/orval/security/advisories/GHSA-q7f2-jg6j-r867","https://www.vulncheck.com/advisories/orval-orval-effect-8.14.0-through-8.28.1-code-injection"],"title":"orval @orval/effect 8.14.0 through 8.28.1 Code Injection","updated":"2026-09-23T16:47:31.442000+00:00","vendors":["orval","orval$PRODUCT$orval"],"weaknesses":["CWE-94"]},"nvd":{"cpes":[],"created":"2026-09-23T17:17:24.607000+00:00","description":"orval versions 8.14.0 through 8.28.1 contain a code injection vulnerability in the @orval/effect generator that converts OpenAPI schema defaults into template literals. Attackers can inject arbitrary JavaScript expressions via schema defaults containing ${...} syntax, which are executed at module scope when the generated code is built or imported.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{"score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"cvssV4_0":{"score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}},"nvd_repo_path":"2026/CVE-2026-96755.json","references":["https://github.com/orval-labs/orval","https://github.com/orval-labs/orval/blob/v8.28.1/packages/effect/src/index.ts#L298-L302","https://github.com/orval-labs/orval/commit/d346d94a660e50a2f8d0f7c17fee2c4c69d8dc23","https://github.com/orval-labs/orval/pull/3995","https://github.com/orval-labs/orval/security/advisories/GHSA-q7f2-jg6j-r867","https://www.vulncheck.com/advisories/orval-orval-effect-8.14.0-through-8.28.1-code-injection"],"title":null,"updated":"2026-09-23T18:16:08.337000+00:00","vendors":[],"weaknesses":["CWE-94"]},"opencve":{"changes":[{"created":"2026-09-23T16:45:00+00:00","data":[{"details":{"new":"orval versions 8.14.0 through 8.28.1 contain a code injection vulnerability in the @orval/effect generator that converts OpenAPI schema defaults into template literals. Attackers can inject arbitrary JavaScript expressions via schema defaults containing ${...} syntax, which are executed at module scope when the generated code is built or imported.","old":null},"type":"description"},{"details":{"new":"orval @orval/effect 8.14.0 through 8.28.1 Code Injection","old":null},"type":"title"},{"details":["orval","orval$PRODUCT$orval"],"type":"first_time"},{"details":{"added":["CWE-94"],"removed":[]},"type":"weaknesses"},{"details":{"added":["cpe:2.3:a:orval:orval:*:*:*:*:*:*:*:*"],"removed":[]},"type":"cpes"},{"details":{"added":["orval","orval$PRODUCT$orval"],"removed":[]},"type":"vendors"},{"details":{"added":["https://github.com/orval-labs/orval","https://github.com/orval-labs/orval/blob/v8.28.1/packages/effect/src/index.ts#L298-L302","https://github.com/orval-labs/orval/commit/d346d94a660e50a2f8d0f7c17fee2c4c69d8dc23","https://github.com/orval-labs/orval/pull/3995","https://github.com/orval-labs/orval/security/advisories/GHSA-q7f2-jg6j-r867","https://www.vulncheck.com/advisories/orval-orval-effect-8.14.0-through-8.28.1-code-injection"],"removed":[]},"type":"references"},{"details":{"added":{"cvssV3_1":{"score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"cvssV4_0":{"score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}},"removed":{},"updated":{}},"type":"metrics"}],"id":"7d63b39c-58b0-4ba8-8e33-207f6c6a4add"},{"created":"2026-09-23T17:30:00+00:00","data":[{"details":{"added":{"ssvc":{"options":{"Automatable":"yes","Exploitation":"none","Technical Impact":"total"},"version":"2.0.3"}},"removed":{},"updated":{}},"type":"metrics"}],"id":"148c61cd-05aa-4728-b8e7-122c55bf0bef"}],"cpes":{"data":["cpe:2.3:a:orval:orval:*:*:*:*:*:*:*:*"],"providers":["mitre"]},"created":{"data":"2026-09-23T16:23:52.011000+00:00","provider":"mitre"},"description":{"data":"orval versions 8.14.0 through 8.28.1 contain a code injection vulnerability in the @orval/effect generator that converts OpenAPI schema defaults into template literals. Attackers can inject arbitrary JavaScript expressions via schema defaults containing ${...} syntax, which are executed at module scope when the generated code is built or imported.","provider":"mitre"},"metrics":{"cvssV2_0":{"data":{},"provider":null},"cvssV3_0":{"data":{},"provider":null},"cvssV3_1":{"data":{"score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"provider":"mitre"},"cvssV4_0":{"data":{"score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"},"provider":"mitre"},"epss":{"data":{},"provider":null},"kev":{"data":{},"provider":null},"ssvc":{"data":{"options":{"Automatable":"yes","Exploitation":"none","Technical Impact":"total"},"version":"2.0.3"},"provider":"vulnrichment"},"threat_severity":{"data":null,"provider":null}},"references":{"data":["https://github.com/orval-labs/orval","https://github.com/orval-labs/orval/blob/v8.28.1/packages/effect/src/index.ts#L298-L302","https://github.com/orval-labs/orval/commit/d346d94a660e50a2f8d0f7c17fee2c4c69d8dc23","https://github.com/orval-labs/orval/pull/3995","https://github.com/orval-labs/orval/security/advisories/GHSA-q7f2-jg6j-r867","https://www.vulncheck.com/advisories/orval-orval-effect-8.14.0-through-8.28.1-code-injection"],"providers":["mitre","nvd","vulnrichment"]},"title":{"data":"orval @orval/effect 8.14.0 through 8.28.1 Code Injection","provider":"mitre"},"updated":{"data":"2026-09-23T17:17:24.607000+00:00","provider":"nvd"},"vendors":{"data":["orval","orval$PRODUCT$orval"],"providers":["mitre","enrichment"]},"weaknesses":{"data":["CWE-94"],"providers":["mitre","nvd"]}},"vulnrichment":{"cpes":[],"created":"2026-09-23T16:23:52.011000+00:00","description":"orval versions 8.14.0 through 8.28.1 contain a code injection vulnerability in the @orval/effect generator that converts OpenAPI schema defaults into template literals. Attackers can inject arbitrary JavaScript expressions via schema defaults containing ${...} syntax, which are executed at module scope when the generated code is built or imported.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{},"cvssV4_0":{},"kev":{},"ssvc":{"options":{"Automatable":"yes","Exploitation":"none","Technical Impact":"total"},"version":"2.0.3"}},"references":["https://github.com/orval-labs/orval/security/advisories/GHSA-q7f2-jg6j-r867"],"title":"orval @orval/effect 8.14.0 through 8.28.1 Code Injection","updated":"2026-09-23T16:47:21.658000+00:00","vendors":[],"vulnrichment_repo_path":"2026/96xxx/CVE-2026-96755.json","weaknesses":[]}}