The CVE-2026-72717 issue involves a critical vulnerability in Orval, a library used to generate type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. The vulnerability permits attacker-controlled JavaScript to be evaluated when the generated zod schema module is imported, resulting in code execution in the developer, CI, test, or application environment. This occurs due [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-19T18:17:24.413Z and has not been modified since then. The CVE-2026-71868 issue is a critical vulnerability in Orval, a tool for generating type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to version 8.21.0, a ${...} expression or backtick in an enum de [truncated]
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-19T18:16:54.383Z and has not been modified since then. The NVD entry is currently Received. Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, an unescaped backtick in an OpenAPI path is emitted into request URL template literal [truncated]
