EUVD-2026-85409
GHSA-vg3c-9fm6-r5pj
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Spec is network-deliverable (AV:N) with no auth (PR:N), but a developer must run codegen on the untrusted spec and execute the generated hooks, so UI:R; injected JS yields full C/I/A in the dev/build context.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
4DescriptionCVE.org
orval before 8.29.0 fails to escape the operationId parameter when emitting it into generated TanStack Query mutator options metadata objects. Attackers can inject arbitrary JavaScript code through a crafted operationId in an OpenAPI specification that executes when generated hooks are called.
AnalysisAI
Code generation in orval before 8.29.0 writes the raw OpenAPI operationId into a single-quoted object literal inside generated TanStack Query mutator metadata, so a crafted operationId can break out of the string and inject arbitrary JavaScript that executes when the generated query or mutation hooks are called. Practical exploitation requires a developer or CI pipeline to run orval codegen against an OpenAPI document whose operationId is attacker-controlled and then to execute the generated hooks - a conditional path that hinges on the trust boundary of the ingested spec, even though PR:N appears in the vector; the independent assessment (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects this required victim interaction, while the headline CVSS 4.0 score of 9.3 (UI:N) overstates how freely the flaw triggers. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that a developer or automated pipeline runs orval (before 8.29.0) code generation against an OpenAPI specification whose operationId field is attacker-controlled, and then the generated TanStack Query/mutation hooks must actually be called for the injected JavaScript to execute. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The headline CVSS 4.0 score is 9.3 (VC:H/VI:H/VA:H, AV:N/PR:N/UI:N), which frames this as critical unauthenticated remote code execution, but that framing is misleading for how the flaw actually triggers. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade orval to 8.29.0 or later, which applies jsStringLiteralEscape to both operationId and operationName via the new getOperationMetaLiteral() helper in packages/query/src/utils.ts (fix landed in PR https://github.com/orval-labs/orval/pull/4008 and commit b28c53f3e0c06190e0f6ea136737e6316432448f); see the advisory at https://github.com/orval-labs/orval/security/advisories/GHSA-vv88-cm6j-665j and the VulnCheck advisory at https://www.vulncheck.com/advisories/orval-before-8.29.0-code-injection-via-operationid. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all repositories, developer endpoints, and CI/CD pipelines using orval versions earlier than 8.29.0, and treat any OpenAPI specification from an untrusted or third-party source as suspect until it can be reviewed; block automatic code generation from unreviewed specs in build pipelines. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
orval (TypeScript API client generator) before 7.18.0 has code injection via OpenAPI specification summary fields in MCP
Arbitrary code execution in Orval (orval-labs/orval) before 8.21.0 allows an attacker who controls an OpenAPI v3 or Swag
Code injection in Orval before 8.21.0 lets an attacker-controlled OpenAPI v3 or Swagger v2 specification execute arbitra
Code injection in Orval before 8.21.0 lets an attacker who controls an OpenAPI v3 or Swagger v2 specification embed exec
Arbitrary code execution in Orval before 8.21.0 arises when the code generator emits an unescaped backtick (or ${...}) f
Code injection in Orval, a TypeScript/JavaScript API client generator, allows a malicious OpenAPI v3 or Swagger v2 speci
Code execution in Orval before 8.21.0 occurs when its zod schema generator processes an attacker-controlled OpenAPI v3 o
Code injection in Orval before 8.21.0 lets an attacker-controlled OpenAPI v3 / Swagger v2 specification achieve arbitrar
Arbitrary code execution in Orval (OpenAPI/Swagger TypeScript client generator) before 8.21.0 lets an attacker who contr
Code injection in Orval (orval-labs/orval) before 8.21.0 allows an attacker who controls an OpenAPI v3 or Swagger v2 spe
Code injection in Orval, a TypeScript client generator for OpenAPI v3 and Swagger v2 specs, allows arbitrary JavaScript
I analyzed the provided intelligence and produced the synthesis below. One thing to flag first: **⚠️ Prompt-injection n
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today