Critical
orval before 8.30.0 Code Injection via Factory Generation
Type: advisorySources: OSV
orval versions before 8.30.0 contain a code injection vulnerability in the @orval/core factory generator that fails to escape date default values in new Date() calls. Attackers can inject arbitrary expressions through apostrophes in OpenAPI schema defaults to execute code with the privileges of the consumer process when factoryMethods and useDates options are enabled.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-96756
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 2 Nov 2026, 18:45 UTC · Revision 1
Source evidence
orval before 8.30.0 Code Injection via Factory Generation
core-osv · Original sourcePublished 23 Sept 2026, 16:23 UTC
orval versions before 8.30.0 contain a code injection vulnerability in the @orval/core factory generator that fails to escape date default values in new Date() calls. Attackers can inject arbitrary expressions through apostrophes in OpenAPI schema defaults to execute code with the privileges of the consumer process when factoryMethods and useDates options are enabled.
osv:CVE-2026-96756
Complete source record
{
"id": "c5845586cc3ac06deefc0d91c980ea1c4c14c0fc8adaf6ff09efe67ad1d41eac",
"url": "https://osv.dev/vulnerability/CVE-2026-96756",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "orval before 8.30.0 Code Injection via Factory Generation",
"summary": "orval versions before 8.30.0 contain a code injection vulnerability in the @orval/core factory generator that fails to escape date default values in new Date() calls. Attackers can inject arbitrary expressions through apostrophes in OpenAPI schema defaults to execute code with the privileges of the consumer process when factoryMethods and useDates options are enabled.",
"evidence": "osv:CVE-2026-96756",
"products": [],
"severity": "critical",
"structured": {
"id": "CVE-2026-96756",
"aliases": [
"CVE-2026-96756",
"GHSA-wx66-36r6-v5g7"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/orval-labs/orval",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "fd3c00d363981267f9a0f5625683ae3d40ad4ff4"
},
{
"fixed": "b9b083576943c683540200eb957feced57dddc1a"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"fixed": "8.30.0"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
},
{
"range": [
{
"fixed": "b9b083576943c683540200eb957feced57dddc1a"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"v8.29.0",
"v8.28.1",
"v8.27.0",
"v8.26.0",
"v8.25.0",
"v8.24.0",
"v8.23.0",
"v8.22.0",
"v8.21.0",
"v8.20.0",
"v8.19.0",
"v8.18.0",
"v8.17.0",
"v8.16.0",
"v8.15.0",
"v8.14.0",
"v8.13.0",
"v8.12.3",
"v8.12.2",
"v8.12.1",
"v8.11.0",
"v8.10.0",
"v8.9.1",
"v8.9.0",
"v8.8.1",
"v8.8.0",
"v8.7.0",
"v8.6.2",
"v8.6.1",
"v8.6.0",
"v8.5.3",
"v8.5.2",
"v8.5.1",
"v8.5.0",
"v8.4.2",
"v8.4.1",
"v8.4.0",
"v8.3.0",
"v8.2.0",
"v8.0.3",
"v8.0.2",
"v8.0.1",
"v8.0.0",
"v8.0.0-rc.6",
"v8.0.0-rc.5",
"v8.0.0-rc.4",
"v8.0.0-rc.3",
"v8.0.0-rc.2",
"v7.15.0",
"v8.0.0-rc.1",
"v8.0.0-rc.0",
"v7.14.0",
"v7.13.2",
"v7.13.1",
"v7.13.0",
"v7.12.2",
"v7.12.1",
"v7.12.0",
"v7.11.2",
"v7.11.1",
"v7.11.0",
"v7.10.0",
"v7.9.0",
"v7.8.0",
"v7.7.0",
"v7.6.0",
"v7.5.0",
"v7.4.1",
"v7.4.0",
"v7.3.0",
"v7.2.0",
"v7.1.1",
"v7.1.0",
"v7.0.1",
"v7.0.0",
"v6.31.0",
"v6.30.2",
"v6.30.1",
"v6.30.0",
"v6.29.1",
"v6.29.0",
"v6.28.2",
"v6.28.1",
"v6.28.0",
"v6.27.1",
"v6.27.0",
"v6.26.0",
"v6.25.0",
"v6.24.0",
"v6.23.0",
"v6.22.1",
"v6.22.0",
"v6.21.0",
"v6.20.0",
"v6.19.1",
"v6.19.0",
"v6.18.1",
"v6.18.0",
"v6.17.0",
"v6.16.0",
"v6.15.0",
"v6.14.4",
"v6.14.3",
"v6.14.2",
"v6.14.1",
"v6.14.0",
"v6.13.1",
"v6.13.0",
"v6.12.1",
"v6.12.0",
"v6.11.1",
"v6.11.0",
"v6.10.3",
"v6.10.2",
"v6.9.6",
"v6.9.5",
"v6.9.4",
"v6.9.3",
"v6.9.2",
"v6.9.1",
"v6.9.0",
"v6.8.1",
"v6.8.0",
"v6.7.1",
"v6.7.0",
"v6.6.4",
"v6.6.3",
"v6.6.2",
"v6.6.1",
"v6.6.0",
"v6.5.3",
"v6.5.2",
"v6.5.1",
"v6.5.0",
"v6.4.3",
"v6.4.2",
"v6.4.1",
"v6.4.0",
"v6.3.0",
"v6.2.3",
"v6.2.2",
"v6.2.1",
"v6.2.0",
"v6.1.2",
"v6.1.1",
"v6.1.0",
"v6.0.4",
"v6.0.3",
"v6.0.2",
"v6.0.1",
"v6.0.0",
"v5.5.0",
"v5.4.14",
"v5.4.13",
"v5.4.12",
"v5.4.11",
"v5.4.10",
"v5.4.9",
"v5.4.8",
"v5.4.7",
"v5.4.6",
"v5.4.5",
"v5.4.4",
"v5.4.3",
"v5.4.2",
"v5.4.1",
"v5.4.0",
"v5.3.2",
"v5.3.1",
"v5.3.0",
"v5.2.0",
"v5.1.4",
"v5.1.3",
"v5.1.2",
"v5.1.1",
"v5.1.0",
"v5.0.0",
"v4.2.0",
"v3.2.3",
"v3.2.2",
"v3.2.1",
"v3.2.0",
"v3.1.9",
"v3.1.8",
"v3.1.7",
"v3.1.6",
"v3.1.5",
"v3.1.4",
"v3.1.3",
"v3.1.2",
"v3.1.1",
"v3.1.0",
"v3.0.3",
"v3.0.2",
"v3.0.1",
"v3.0.0",
"v2.6.0",
"v2.5.9",
"v2.5.8",
"v2.5.7",
"v2.5.6",
"v2.5.5",
"v2.5.4",
"v2.5.3",
"v2.5.2",
"v2.5.1",
"v2.5.0",
"v2.4.1",
"v2.4.0",
"v2.3.1",
"v2.3.0",
"v2.2.2",
"v2.2.1",
"v2.2.0",
"v2.1.2",
"v2.1.1",
"v2.1.0",
"v2.0.7",
"v2.0.6",
"v2.0.5",
"v2.0.4",
"v2.0.3",
"v2.0.2",
"v2.0.1",
"v2.0.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-96756.json"
}
}
],
"modified": "2026-10-28T02:30:22.319074326Z",
"provider": "osv",
"references": [
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/96xxx/CVE-2026-96756.json",
"https://github.com/orval-labs/orval/security/advisories/GHSA-wx66-36r6-v5g7",
"https://nvd.nist.gov/vuln/detail/CVE-2026-96756",
"https://www.vulncheck.com/advisories/orval-before-8.30.0-code-injection-via-factory-generation",
"https://github.com/orval-labs/orval/commit/b9b083576943c683540200eb957feced57dddc1a",
"https://github.com/orval-labs/orval/pull/4038",
"https://github.com/orval-labs/orval",
"https://github.com/orval-labs/orval/blob/v8.29.0/packages/core/src/generators/factory.ts#L493"
],
"provider_metadata": {
"cwe_ids": [
"CWE-94"
],
"cna_assigner": "VulnCheck",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/96xxx/CVE-2026-96756.json"
}
},
"related_cves": [
{
"value": "CVE-2026-96756",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 488712,
"published_at": "2026-09-23T16:23:53.491+00:00"
}