orval-labs
- Total products in the ecosystem
- 1
- Total vulnerabilities (90 days)
- 18
- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
A short verification protects source data and prevents automated AI requests.
Verifying...
As of 11/08/2026, orval-labs recorded 18 security vulnerabilities in the last 90 days across 1 products, including 18 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, orval had the most security vulnerabilities in the orval-labs ecosystem, with 18 vulnerabilities—approximately 100% of the provider's total vulnerabilities during this period.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-96759orval before 8.29.0 Code Injection via operationIdCVE-2026-96758orval @orval/core before 8.28.0 Code Injection via Form-DataCVE-2026-96757orval before 8.29.0 Code Injection via unescaped OpenAPI media-typeCVE-2026-96756orval before 8.30.0 Code Injection via Factory GenerationCVE-2026-96755orval @orval/effect 8.14.0 through 8.28.1 Code Injection| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-96759orval before 8.29.0 Code Injection via operationId | Exploitation statusActively exploited | FixYes |
| Published09/23/2026 |
| SeverityCritical |
CVE-2026-96758orval @orval/core before 8.28.0 Code Injection via Form-Data | Exploitation statusActively exploited | FixYes | Affected productorval | Published09/23/2026 | SeverityCritical |
|---|
CVE-2026-96757orval before 8.29.0 Code Injection via unescaped OpenAPI media-type | Exploitation statusActively exploited | FixYes | Affected productorval | Published09/23/2026 | SeverityCritical |
|---|
CVE-2026-96756orval before 8.30.0 Code Injection via Factory Generation | Exploitation statusNot exploited | FixYes | Affected productorval | Published09/23/2026 | SeverityCritical |
|---|
CVE-2026-96755orval @orval/effect 8.14.0 through 8.28.1 Code Injection | Exploitation statusNot exploited | FixYes | Affected productorval | Published09/23/2026 | SeverityCritical |
|---|
CVE-2026-96754orval @orval/hono before 8.29.0 Code Injection via OpenAPI Path | Exploitation statusActively exploited | FixYes | Affected productorval | Published09/23/2026 | SeverityCritical |
|---|
CVE-2026-72717Orval: Import-time RCE via schema default -> zod module-level template literal | Exploitation statusActively exploited | FixYes | Affected productorval | Published08/19/2026 | SeverityCritical |
|---|
CVE-2026-72716Orval: Import-time RCE via query-parameter default -> zod module-level template literal | Exploitation statusActively exploited | FixYes | Affected productorval | Published08/19/2026 | SeverityCritical |
|---|
CVE-2026-71871Orval: Import-time RCE via header-parameter default -> zod module-level template literal | Exploitation statusNot exploited | FixYes | Affected productorval | Published08/19/2026 | SeverityCritical |
|---|
CVE-2026-71869Orval: Import-time RCE via array-items default -> zod module-level template literal | Exploitation statusActively exploited | FixYes | Affected productorval | Published08/19/2026 | SeverityCritical |
|---|
CVE-2026-71868Orval: Import-time RCE via enum-typed default -> zod module-level template literal | Exploitation statusActively exploited | FixYes | Affected productorval | Published08/19/2026 | SeverityCritical |
|---|
CVE-2026-71867Orval: RCE via schema property name -> computed-property-key injection in the MSW mock generator | Exploitation statusActively exploited | FixYes | Affected productorval | Published08/19/2026 | SeverityCritical |
|---|
CVE-2026-71866Orval: Import-time RCE via schema property name -> computed-property-key injection in the zod client | Exploitation statusActively exploited | FixYes | Affected productorval | Published08/19/2026 | SeverityCritical |
|---|
CVE-2026-71865Orval: Import-time RCE via query parameter name -> computed-property-key injection in the zod cli | Exploitation statusNot exploited | FixYes | Affected productorval | Published08/19/2026 | SeverityCritical |
|---|
CVE-2026-71864Orval: Import-time RCE via header parameter name -> computed-property-key injection in the zod client | Exploitation statusActively exploited | FixYes | Affected productorval | Published08/19/2026 | SeverityCritical |
|---|
CVE-2026-62682Orval: RCE via servers[].url -> unescaped request-URL template literal (with getBaseUrlFromSpecification) | Exploitation statusActively exploited | FixYes | Affected productorval | Published08/19/2026 | SeverityCritical |
|---|
CVE-2026-62681Orval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout) | Exploitation statusActively exploited | FixYes | Affected productorval | Published08/19/2026 | SeverityCritical |
|---|
CVE-2026-62680Orval: Generation-time SSRF + remote/local file inclusion via unrestricted $ref | Exploitation statusActively exploited | FixYes | Affected productorval | Published08/19/2026 | SeverityHigh |
|---|
CVE-2026-25141Orval has a code injection via unsanitized x-enum-descriptions uing JS comments | Exploitation statusNot exploited | FixNo | Affected productorval | Published01/30/2026 | SeverityCritical |
|---|
CVE-2026-24132Orval Mock Generation Code Injection via const | Exploitation statusNot exploited | FixYes | Affected productorval | Published01/22/2026 | SeverityHigh |
|---|
CVE-2026-23947Orval MCP client is vulnerable to code injection via unsanitized x-enum-descriptions in enum generation | Exploitation statusNot exploited | FixNo | Affected productorval | Published01/20/2026 | SeverityCritical |
|---|
CVE-2026-22785orval MCP client is vulnerable to a code injection attack. | Exploitation statusNot exploited | FixYes | Affected productorval | Published01/12/2026 | SeverityCritical |
|---|
22 Results | Page 1 of 1