PT-2026-97410

CVE-2026-96757

Published

2026-09-23

Updated

2026-09-24

Description by

CVSS 3.1

9.8

Critical

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions orval versions prior to 8.29.0

Description The software fails to escape OpenAPI media-type keys when emitting them into single-quoted Content-Type string literals in generated code. This allows attackers to inject JavaScript via crafted media-type keys in OpenAPI specifications, which then executes when generated fetch operations or mock resolvers are invoked.

Recommendations Update orval to version 8.29.0 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Enrik Mustafa

Vendors

Affected products

Weakness enumeration

CWE-94: Improper Control of Generation of Code (\'Code Injection\')

Related identifiers