[ Vendor · 6 CVEs ]
orval-labs
CVEs affecting orval-labs published in the last 30 days, plus any orval-labs CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-96758 | 23 Sep 2026 | CVSS 9.8 | orval-labs orvalorval @orval/core before 8.28.0 contains a code injection vulnerability in the form-data serializer that fails to escape multipart property names in… | |
| CVE-2026-96759 | 23 Sep 2026 | CVSS 9.8 | orval-labs orvalorval before 8.29.0 fails to escape the operationId parameter when emitting it into generated TanStack Query mutator options metadata objects… | |
| CVE-2026-96754 | 23 Sep 2026 | CVSS 9.8 | orval-labs orvalorval versions before 8.29.0 contain a code injection vulnerability in the @orval/hono generator that fails to escape OpenAPI path values in… | |
| CVE-2026-96755 | 23 Sep 2026 | CVSS 9.8 | orval-labs orvalorval versions 8.14.0 through 8.28.1 contain a code injection vulnerability in the @orval/effect generator that converts OpenAPI schema defaults into… | |
| CVE-2026-96756 | 23 Sep 2026 | CVSS 8.1 | orval-labs orvalorval versions before 8.30.0 contain a code injection vulnerability in the @orval/core factory generator that fails to escape date default values in… | |
| CVE-2026-96757 | 23 Sep 2026 | CVSS 9.8 | orval-labs orvalorval before 8.29.0 fails to escape OpenAPI media-type keys when emitting them into single-quoted Content-Type string literals in generated code… |