orval
- Software type
- Developer tool
- Total vulnerabilities (90 days)
- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
As of 11/08/2026, orval recorded 18 security vulnerabilities in the last 90 days, of which 18 are rated High or Critical. None of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of orval and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-96759orval before 8.29.0 Code Injection via operationIdCVE-2026-96758orval @orval/core before 8.28.0 Code Injection via Form-DataCVE-2026-96757orval before 8.29.0 Code Injection via unescaped OpenAPI media-typeCVE-2026-96756orval before 8.30.0 Code Injection via Factory GenerationCVE-2026-96755orval @orval/effect 8.14.0 through 8.28.1 Code Injection| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-96759orval before 8.29.0 Code Injection via operationId | Exploitation statusActively exploited | FixYes |
| SeverityCritical |
CVE-2026-96758orval @orval/core before 8.28.0 Code Injection via Form-Data | Exploitation statusActively exploited | FixYes | Published09/23/2026 | SeverityCritical |
|---|
CVE-2026-96757orval before 8.29.0 Code Injection via unescaped OpenAPI media-type | Exploitation statusActively exploited | FixYes | Published09/23/2026 | SeverityCritical |
|---|
CVE-2026-96756orval before 8.30.0 Code Injection via Factory Generation | Exploitation statusNot exploited | FixYes | Published09/23/2026 | SeverityCritical |
|---|
CVE-2026-96755orval @orval/effect 8.14.0 through 8.28.1 Code Injection | Exploitation statusNot exploited | FixYes | Published09/23/2026 | SeverityCritical |
|---|
CVE-2026-96754orval @orval/hono before 8.29.0 Code Injection via OpenAPI Path | Exploitation statusActively exploited | FixYes | Published09/23/2026 | SeverityCritical |
|---|
CVE-2026-72717Orval: Import-time RCE via schema default -> zod module-level template literal | Exploitation statusActively exploited | FixYes | Published08/19/2026 | SeverityCritical |
|---|
CVE-2026-72716Orval: Import-time RCE via query-parameter default -> zod module-level template literal | Exploitation statusActively exploited | FixYes | Published08/19/2026 | SeverityCritical |
|---|
CVE-2026-71871Orval: Import-time RCE via header-parameter default -> zod module-level template literal | Exploitation statusNot exploited | FixYes | Published08/19/2026 | SeverityCritical |
|---|
CVE-2026-71869Orval: Import-time RCE via array-items default -> zod module-level template literal | Exploitation statusActively exploited | FixYes | Published08/19/2026 | SeverityCritical |
|---|
CVE-2026-71868Orval: Import-time RCE via enum-typed default -> zod module-level template literal | Exploitation statusActively exploited | FixYes | Published08/19/2026 | SeverityCritical |
|---|
CVE-2026-71867Orval: RCE via schema property name -> computed-property-key injection in the MSW mock generator | Exploitation statusActively exploited | FixYes | Published08/19/2026 | SeverityCritical |
|---|
CVE-2026-71866Orval: Import-time RCE via schema property name -> computed-property-key injection in the zod client | Exploitation statusActively exploited | FixYes | Published08/19/2026 | SeverityCritical |
|---|
CVE-2026-71865Orval: Import-time RCE via query parameter name -> computed-property-key injection in the zod cli | Exploitation statusNot exploited | FixYes | Published08/19/2026 | SeverityCritical |
|---|
CVE-2026-71864Orval: Import-time RCE via header parameter name -> computed-property-key injection in the zod client | Exploitation statusActively exploited | FixYes | Published08/19/2026 | SeverityCritical |
|---|
CVE-2026-62682Orval: RCE via servers[].url -> unescaped request-URL template literal (with getBaseUrlFromSpecification) | Exploitation statusActively exploited | FixYes | Published08/19/2026 | SeverityCritical |
|---|
CVE-2026-62681Orval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout) | Exploitation statusActively exploited | FixYes | Published08/19/2026 | SeverityCritical |
|---|
CVE-2026-62680Orval: Generation-time SSRF + remote/local file inclusion via unrestricted $ref | Exploitation statusActively exploited | FixYes | Published08/19/2026 | SeverityHigh |
|---|
CVE-2026-25141Orval has a code injection via unsanitized x-enum-descriptions uing JS comments | Exploitation statusNot exploited | FixNo | Published01/30/2026 | SeverityCritical |
|---|
CVE-2026-24132Orval Mock Generation Code Injection via const | Exploitation statusNot exploited | FixYes | Published01/22/2026 | SeverityHigh |
|---|
CVE-2026-23947Orval MCP client is vulnerable to code injection via unsanitized x-enum-descriptions in enum generation | Exploitation statusNot exploited | FixNo | Published01/20/2026 | SeverityCritical |
|---|
CVE-2026-22785orval MCP client is vulnerable to a code injection attack. | Exploitation statusNot exploited | FixYes | Published01/12/2026 | SeverityCritical |
|---|
22 Results | Page 1 of 1