CVE-2026-96754 is a critical code injection vulnerability in orval before version 8.29.0: a crafted OpenAPI document can place arbitrary JavaScript in the TypeScript module generated by the @orval/hono generator.
What Is It
orval is an npm package (pkg:npm/orval) maintained by orval-labs. According to the NVD record, its @orval/hono generator doesn't escape OpenAPI path values when it writes them into single-quoted route literals. An attacker can put an apostrophe in a static path segment of an OpenAPI document. That breaks out of the string literal and injects arbitrary JavaScript into the generated TypeScript module. The injected code runs when the module is imported.
The weakness is classified as CWE-94 (Improper Control of Generation of Code). VulnCheck disclosed the issue, and NVD published the record on 2026-09-23. Its NVD status is currently "Received."
Why It Matters
VulnCheck scores this as critical:
- CVSS 3.1: 9.8 (CRITICAL),
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 4.0: 9.3 (CRITICAL)
The CVSS 3.1 vector rates the attack as network-reachable and low-complexity, with no privileges or user interaction required, and rates the impact to confidentiality, integrity and availability as high. The CVSS 4.0 vector string was not included in the available record. The risk applies to any pipeline that generates Hono code from an OpenAPI document an attacker can influence, because the injected code runs wherever the generated module is imported.
Exploitation status: No CISA Known Exploited Vulnerabilities (KEV) entry was supplied for this CVE, so KEV does not currently confirm active exploitation.
What's Vulnerable
- Vendor: orval-labs
- Product: orval (npm)
- Affected: all versions before 8.29.0 (semver)
- Not affected: 8.29.0
- Component: the
@orval/honogenerator
The vulnerable code in v8.28.1 is at packages/hono/src/index.ts, lines 169–175.
Patch Status
A fix is available. The affected-version data lists orval 8.29.0 as unaffected. Users of the Hono generator should upgrade to 8.29.0 or later. The fix is tracked in pull request #4006 and in commits 155a5b7 and d346d94. The GitHub security advisory is GHSA-g4mf-q5hw-f9j9. No CISA KEV required action or due date applies, because there is no KEV entry.