CVE-2026-96755 is a critical code injection flaw in orval versions 8.14.0 through 8.28.1. Attacker-controlled OpenAPI schema defaults can run arbitrary JavaScript when the generated code is built or imported.
What Is It
The flaw is in orval's @orval/effect generator, which turns default values from OpenAPI schemas into JavaScript template literals. The generator does not neutralize ${...} syntax in those defaults. An attacker who controls a schema default can therefore inject an arbitrary JavaScript expression into the generated output. That expression runs at module scope when the generated code is built or imported.
The weakness is CWE-94 (Improper Control of Generation of Code). VulnCheck disclosed the issue, and NVD published it on September 23, 2026. The NVD record status is "Deferred."
Why It Matters
VulnCheck scores this 9.8 CRITICAL under CVSS 3.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and 9.3 CRITICAL under CVSS 4.0. The vector means network attack, low complexity, no privileges and no user interaction, with high impact to confidentiality, integrity and availability.
CISA's SSVC assessment (as coordinator) rates the issue as automatable, with total technical impact. It lists exploitation as "none" at this time. CVE-2026-96755 is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, so KEV does not confirm active exploitation of this CVE.
The injected code runs whenever generated code is built or imported. That means it can run on developer machines and in build pipelines that process an untrusted or tampered OpenAPI specification.
What's Vulnerable
- Vendor: orval-labs
- Product: orval (
pkg:npm/orval) - Affected: versions 8.14.0 up to, but not including, 8.29.0 (semver)
- Unaffected: 8.29.0
- Component: the
@orval/effectgenerator (seepackages/effect/src/index.ts, lines 298–302, in v8.28.1)
Patch Status
The affected-version data lists orval 8.29.0 as unaffected. Upgrade the orval npm package to 8.29.0 or later. The upstream fix is referenced as commit d346d94 and pull request #3995. The project has also published GitHub Security Advisory GHSA-q7f2-jg6j-r867.
The CISA KEV catalog has no entry for this CVE, so no KEV required action or due date applies.