PT-2026-78551

CVE-2026-71867

Published

2026-08-19

Updated

2026-09-21

Description by

CVSS 4.0

9.3

Critical

MetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Orval versions prior to 8.21.0

Description Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. A flaw exists where a single quote in a schema property name is emitted into single-quoted object keys in generated MSW (Mock Service Worker) mock factories without safe encoding. This allows attacker-controlled JavaScript to be evaluated when the generated mock factory is called by tests or an MSW handler, leading to code execution in the developer, CI, test, or application environment. The issue resides in the getKey() function within packages/core/src/getters/keys.ts and the MSW mock generation process.

Recommendations Update to version 8.21.0.

Exploitability

Exploit

Fix

Impacts

Vendors

Affected products

Weakness enumeration

CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code (\'Eval Injection\')

CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\'SQL Injection\')

Related identifiers

CVE-2026-71867