CVE-2026-96759 orval-labs CVE debrief

Who should care

Defenders responsible for maintaining orval dependencies, developers using orval for OpenAPI specification processing, and security teams assessing exposure to code injection attacks should prioritize verifying exposure and assessing the feasibility of attacks.

Why it matters

CVE-2026-96759 allows for potential JavaScript code injection through crafted operationId parameters in OpenAPI specifications, impacting orval versions before 8.29.0. Defenders should prioritize verifying exposure, assessing attack feasibility, and updating orval to mitigate the vulnerability.

• Code injection attacks through crafted operationId parameters in OpenAPI specifications.
• Potential execution of arbitrary JavaScript code when generated hooks are called.
• Verification of orval version exposure in the environment.
• Prioritization of orval updates to version 8.29.0 or later.

Technical summary

The orval library before version 8.29.0 fails to properly escape the operationId parameter when generating TanStack Query mutator options metadata objects. This vulnerability allows attackers to inject arbitrary JavaScript code through crafted operationId parameters in OpenAPI specifications, which can be executed when generated hooks are called. The vulnerability impacts orval users who process OpenAPI specifications, and defenders should prioritize verifying exposure of orval versions before 8.29.0 and assessing the feasibility of code injection attacks.

Defensive priority

Defenders should prioritize verifying exposure of orval versions before 8.29.0 and assessing the feasibility of code injection attacks through crafted operationId parameters in OpenAPI specifications.

Recommended defensive actions

• Verify exposure of orval versions before 8.29.0 in your environment.
• Assess the feasibility of code injection attacks through crafted operationId parameters in OpenAPI specifications.
• Update orval to version 8.29.0 or later to mitigate the vulnerability.
• Review and validate the operationId parameter in your OpenAPI specifications to prevent potential code injection attacks.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and source references indicate that orval before 8.29.0 fails to escape the operationId parameter, allowing for potential JavaScript code injection through crafted OpenAPI specifications.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.