EUVD-2026-85406
GHSA-j4vv-v4c9-8599
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attacker supplies a malicious spec (PR:N) but a developer must enable non-default options and run codegen/output (UI:R); resulting arbitrary code exec gives full C/I/A in the consumer process (S:U).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
5DescriptionCVE.org
orval versions before 8.30.0 contain a code injection vulnerability in the @orval/core factory generator that fails to escape date default values in new Date() calls. Attackers can inject arbitrary expressions through apostrophes in OpenAPI schema defaults to execute code with the privileges of the consumer process when factoryMethods and useDates options are enabled.
Articles & Coverage 1
AnalysisAI
Code injection in the Orval OpenAPI-to-TypeScript client generator (@orval/core) before 8.30.0 lets an attacker who controls the default value of a date or date-time field in an OpenAPI schema splice arbitrary JavaScript into generated factory code, which then executes with the privileges of whatever process consumes the generated client. Exploitation is not remote against a deployed service: it requires the non-default factoryMethods and useDates options to be enabled, a developer running codegen against a spec the attacker can influence, and the resulting factory client being executed, giving an assessed CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (the advisory lists 9.2 under CVSS 4.0). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of: (1) the orval `factoryMethods` option enabled AND the `useDates` option enabled (both non-default); (2) the developer running codegen against an OpenAPI schema the attacker can influence, containing a date or date-time field whose `default` value carries an unescaped apostrophe/backslash; and (3) the generated factory client being executed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a CWE-94 code injection in the @orval/core factory generator (orval <8.30.0), a developer-time TypeScript OpenAPI client generator. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Orval 8.30.0 or later, the first release outside the affected range; the fix adds jsStringLiteralEscape for date defaults and is delivered via PR #4038 (https://github.com/orval-labs/orval/pull/4038) and commit b9b0835 (https://github.com/orval-labs/orval/commit/b9b083576943c683540200eb957feced57dddc1a), with the advisory at https://github.com/orval-labs/orval/security/advisories/GHSA-wx66-36r6-v5g7. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every repository, developer workstation, and CI/CD runner that depends on @orval/core or the orval package, flag any pinned below 8.30.0, and audit codegen configurations for the non-default factoryMethods and useDates options, since both must be enabled for the injection path to be reachable; treat any build that generated factory clients from an externally or untrusted-supplied OpenAPI spec as potentially compromised. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today