Critical severity9.8NVD Advisory· Published Sep 23, 2026· Updated Sep 23, 2026
CVE-2026-96757
CVE-2026-96757
Description
orval before 8.29.0 fails to escape OpenAPI media-type keys when emitting them into single-quoted Content-Type string literals in generated code. Attackers can inject JavaScript through crafted media-type keys in OpenAPI specifications that executes when generated fetch operations or mock resolvers are invoked.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <8.29.0
Patches
Vulnerability mechanics
References
7- github.com/orval-labs/orval/blob/v8.28.1/packages/fetch/src/index.tsnvd
- github.com/orval-labs/orval/commit/43af282d62dca0ef3140023741fb768f6a718adbnvd
- github.com/orval-labs/orval/commit/a2d4af59f3b167dc8a7a65d15f51cdb89ebe2fe5nvd
- github.com/orval-labs/orval/pull/4007nvd
- github.com/orval-labs/orval/security/advisories/GHSA-4q3x-rqfw-3x8pnvd
- github.com/orval-labs/orval/security/advisories/GHSA-rcpr-mq4m-jx9jnvd
- www.vulncheck.com/advisories/orval-before-8.29.0-code-injection-via-unescaped-openapi-media-typenvd
News mentions
0No linked articles in our index yet.