PT-2026-97407

CVE-2026-96754

Published

2026-09-23

Updated

2026-09-29

Description by

CVSS 3.1

9.8

Critical

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions orval versions prior to 8.29.0

Description The @orval/hono generator fails to escape OpenAPI path values within single-quoted route literals. This allows an attacker to craft an OpenAPI document containing an apostrophe in a static path segment, leading to the injection of arbitrary JavaScript code that executes upon the import of the generated TypeScript module.

Recommendations Update orval to version 8.29.0 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Enrik Mustafa

Vendors

Affected products

Weakness enumeration

CWE-94: Improper Control of Generation of Code (\'Code Injection\')

Related identifiers