CVE-2026-96758

EUVD-2026-85408
orval @orval/core before 8.28.0 contains a code injection vulnerability in the form-data serializer that fails to escape multipart property names in generated template literals. Attackers can inject ${...} expressions into OpenAPI schema property names that execute as live interpolation when the generated client builds FormData bodies with consumer process privileges.
Code Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
orvalorval
𝑥
< 8.28.0
CNA
Common Weakness Enumeration
References
https://github.com/orval-labs/orval
https://github.com/orval-labs/orval/blob/v8.27.0/packages/core/src/getters/res-req-types.ts#L808
https://github.com/orval-labs/orval/commit/975a769a76151354dead879feadfa3537ff065fe
https://github.com/orval-labs/orval/pull/3988
https://github.com/orval-labs/orval/security/advisories/GHSA-jwhm-6748-j6pq
https://www.vulncheck.com/advisories/orval-orval-core-before-8.28.0-code-injection-via-form-data
https://github.com/orval-labs/orval/security/advisories/GHSA-jwhm-6748-j6pq