Skip to content
OpenAdvisories

Vendor

orval-labs

22 known vulnerabilities.

Products

orval 22
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 8.1
    CVE-2026-96756

    orval before 8.30.0 Code Injection via Factory Generation

    orval versions before 8.30.0 contain a code injection vulnerability in the @orval/core factory generator that fails to escape date default values in new Date() calls. Attackers can inject arbitrary expressions through apostrophes in OpenAPI schema defaults to…

    orval-labs orval
  • High 7.1
    CVE-2026-62680

    Orval: Generation-time SSRF + remote/local file inclusion via unrestricted $ref

    Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.22.0, Orval resolves remote and local external $ref values without an allowlist or confinement to the input directory. Processing an attacker-…

    orval-labs orval orval npm
  • High 7.7
    CVE-2026-24132

    Orval Mock Generation Code Injection via const

    Orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification. Versions 7.19.0 and below and 8.0.0-rc.0 through 8.0.2 allow untrusted OpenAPI specifications to inject arbitrary TypeScript/JavaScript into generated moc…

    orval-labs orval @orval/mock npm