PT-2026-97412

CVE-2026-96759

Published

2026-09-23

Updated

2026-09-29

Description by

CVSS 3.1

9.8

Critical

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions orval versions prior to 8.29.0

Description The software fails to escape the operationId parameter when emitting it into generated TanStack Query mutator options metadata objects. This allows attackers to inject arbitrary JavaScript code via a crafted operationId within an OpenAPI specification, which then executes when the generated hooks are called.

Recommendations Update orval to version 8.29.0 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Enrik Mustafa

Vendors

Affected products

Weakness enumeration

CWE-94: Improper Control of Generation of Code (\'Code Injection\')

Related identifiers