Which versions of Ssti are affected by CVE-2026-72716?

Orval versions before 8.21.0, a critical OpenAPI code generator used throughout development pipelines, contain a code injection vulnerability that executes arbitrary code during the build process.. A patch is available.

Is there a public PoC exploit available for CVE-2026-72716?

Yes, a public proof-of-concept exploit is available for CVE-2026-72716. Prioritise patching immediately. EPSS: 0.5%.

How to fix or mitigate CVE-2026-72716?

Within 24 hours: Audit all development teams and CI/CD infrastructure for Orval usage and identify current versions in use. Within 7 days: Upgrade all affected systems to Orval 8.21.0 or later and verify via dependency scanning (npm audit, yarn audit, or platform-specific equivalents); restart all CI/CD pipelines and regenerate any affected code modules. Within 30 days: Audit generated code and CI/CD logs from the vulnerable period for suspicious activity, rotate any credentials that may have been exposed in development or build environments, and establish continuous monitoring of Orval security advisories.

Ssti CVE-2026-72716

Q: What is the CVSS score of CVE-2026-72716?

CVE-2026-72716 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

EUVD-2026-62600 CRITICAL

Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)

2026-08-19 GitHub_M

GHSA-p4cg-3328-rvfg

RCE Ssti Orval Orval Labs

9.3

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Aug 19, 2026 - 18:21 vuln.today

Analysis Generated

Aug 19, 2026 - 18:21 vuln.today

Patch available

Aug 19, 2026 - 18:03 EUVD

CVE Published

Aug 19, 2026 - 17:33 cve.org

CRITICAL 9.3

DescriptionCVE.org

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, a ${...} expression or backtick in a query parameter default is emitted into a module-level template literal emitted by zod schema generation without safe encoding. This permits attacker-controlled JavaScript to be evaluated when the generated zod schema module is imported, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/zod/src/index.ts function formatDefaultValue. This issue is fixed in version 8.21.0.

AnalysisAI

Code injection in Orval before 8.21.0 lets an attacker-controlled OpenAPI v3 or Swagger v2 specification execute arbitrary JavaScript when the generated zod schema module is imported. Because formatDefaultValue in packages/zod/src/index.ts emits a query-parameter default containing a ${...} expression or backtick directly into a module-level template literal without escaping, the payload runs in whatever environment loads the generated code — the developer workstation, CI pipeline, test runner, or the built application. Publicly available exploit code exists (SSVC: PoC) and the flaw is rated automatable with total technical impact; there is no public evidence of active exploitation.