CVE Explorer

CVE-2026-24132

Orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification. Versions 7.19.0 and below and 8.0.0-rc.0 through 8.0.2 allow untrusted OpenAPI specifications to inject arbitrary TypeScript/JavaScript into generated mock files via the const keyword on schema properties. These const values are interpolated into the mock scalar generator (getMockScalar in packages/mock/src/faker/getters/scalar.ts) without proper escaping or type-safe serialization, which re

Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:23f5de122a5f4deb12a1048b05eabcd266a6211beab31b70f3703be6fcbd6b82

Known exploited

Not asserted

Disputed

Stale source

Conflicts

Affected products and versions

1 source assertion

{"product":"orval","vendor":"orval-labs","versions":[{"status":"affected","version":"< 7.20.0"},{"status":"affected","version":">= 8.0.0-rc.0, < 8.0.3"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:24a499c1f467a404029a42c10e3bf23a1397122e2c3fe93373d186d827d0c3a0 · sha256:729cf11db4861166… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion

{"metric":{"attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","baseScore":7.7,"baseSeverity":"HIGH","privilegesRequired":"NONE","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"PASSIVE","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH"},"metric_type":"cvssV4_0"}

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:24a499c1f467a404029a42c10e3bf23a1397122e2c3fe93373d186d827d0c3a0 · sha256:729cf11db4861166… · /containers/cna/metrics/0/cvssV4_0

CWE assertions

1 source assertion

{"cweId":"CWE-77","description":"CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:24a499c1f467a404029a42c10e3bf23a1397122e2c3fe93373d186d827d0c3a0 · sha256:729cf11db4861166… · /containers/cna/problemTypes/0/descriptions/0

Source references

9 source assertions

{"name":"https://github.com/orval-labs/orval/commit/44ca8c1f5f930a3e4cefb6b79b38bcde7f8532a5","tags":["x_refsource_MISC"],"url":"https://github.com/orval-labs/orval/commit/44ca8c1f5f930a3e4cefb6b79b38bcde7f8532a5"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:24a499c1f467a404029a42c10e3bf23a1397122e2c3fe93373d186d827d0c3a0 · sha256:729cf11db4861166… · /containers/cna/references/4

{"name":"https://github.com/orval-labs/orval/commit/6d8ece07ccb80693ad43edabccb3957aceadcd06","tags":["x_refsource_MISC"],"url":"https://github.com/orval-labs/orval/commit/6d8ece07ccb80693ad43edabccb3957aceadcd06"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:24a499c1f467a404029a42c10e3bf23a1397122e2c3fe93373d186d827d0c3a0 · sha256:729cf11db4861166… · /containers/cna/references/5

{"name":"https://github.com/orval-labs/orval/commit/9b211cddc9f009f8a671e4ac5c6cb72cd8646b62","tags":["x_refsource_MISC"],"url":"https://github.com/orval-labs/orval/commit/9b211cddc9f009f8a671e4ac5c6cb72cd8646b62"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:24a499c1f467a404029a42c10e3bf23a1397122e2c3fe93373d186d827d0c3a0 · sha256:729cf11db4861166… · /containers/cna/references/6

{"name":"https://github.com/orval-labs/orval/pull/2828","tags":["x_refsource_MISC"],"url":"https://github.com/orval-labs/orval/pull/2828"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:24a499c1f467a404029a42c10e3bf23a1397122e2c3fe93373d186d827d0c3a0 · sha256:729cf11db4861166… · /containers/cna/references/1

{"name":"https://github.com/orval-labs/orval/pull/2829","tags":["x_refsource_MISC"],"url":"https://github.com/orval-labs/orval/pull/2829"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:24a499c1f467a404029a42c10e3bf23a1397122e2c3fe93373d186d827d0c3a0 · sha256:729cf11db4861166… · /containers/cna/references/2

{"name":"https://github.com/orval-labs/orval/pull/2830","tags":["x_refsource_MISC"],"url":"https://github.com/orval-labs/orval/pull/2830"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:24a499c1f467a404029a42c10e3bf23a1397122e2c3fe93373d186d827d0c3a0 · sha256:729cf11db4861166… · /containers/cna/references/3

{"name":"https://github.com/orval-labs/orval/releases/tag/v7.20.0","tags":["x_refsource_MISC"],"url":"https://github.com/orval-labs/orval/releases/tag/v7.20.0"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:24a499c1f467a404029a42c10e3bf23a1397122e2c3fe93373d186d827d0c3a0 · sha256:729cf11db4861166… · /containers/cna/references/7

{"name":"https://github.com/orval-labs/orval/releases/tag/v8.0.3","tags":["x_refsource_MISC"],"url":"https://github.com/orval-labs/orval/releases/tag/v8.0.3"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:24a499c1f467a404029a42c10e3bf23a1397122e2c3fe93373d186d827d0c3a0 · sha256:729cf11db4861166… · /containers/cna/references/8

{"name":"https://github.com/orval-labs/orval/security/advisories/GHSA-f456-rf33-4626","tags":["x_refsource_CONFIRM"],"url":"https://github.com/orval-labs/orval/security/advisories/GHSA-f456-rf33-4626"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:24a499c1f467a404029a42c10e3bf23a1397122e2c3fe93373d186d827d0c3a0 · sha256:729cf11db4861166… · /containers/cna/references/0

Attribution and limitations

CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer