Orval versions before 8.29.0 do not escape the operationId field when generating TanStack Query code, so a crafted OpenAPI specification can inject JavaScript that runs when the generated hooks are called.
What Is It
CVE-2026-96759 is a code injection flaw (CWE-94) in orval, an npm package from orval-labs. Orval generates client code from OpenAPI specifications. When it writes an operationId into the mutator options metadata objects of generated TanStack Query code, it does not escape the value first.
An attacker who can control the operationId in an OpenAPI specification can insert arbitrary JavaScript. That code becomes part of the generated output and runs when the generated hooks are called. The NVD record points to the relevant code in packages/query/src/query-generator.ts (line 784 in v8.28.1).
VulnCheck reported the issue, and NVD published it on 2026-09-23. NVD lists the record's status as "Deferred."
Why It Matters
VulnCheck scores the flaw as critical:
- CVSS 3.1: 9.8 CRITICAL (
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) - CVSS 4.0: 9.3 CRITICAL
Both scores rate the attack as network-reachable and low in complexity, with no privileges or user interaction required. Both rate the impact on confidentiality, integrity and availability as high.
The injected code does not stay in the build step. It ends up in generated application code and runs whenever those hooks are called. Projects that run affected orval versions on OpenAPI specs they do not fully control may be exposed. Actual risk depends on whether the TanStack Query generator is in use, who can change the input specs, and whether the generated hooks run in production.
KEV status: At the time of writing, CVE-2026-96759 does not appear in the CISA Known Exploited Vulnerabilities catalog. The available sources do not confirm active exploitation.
What's Vulnerable
- Vendor: orval-labs
- Product: orval (
pkg:npm/orval) - Affected: all versions before 8.29.0 (semver)
- Unaffected: 8.29.0
The flaw is in the TanStack Query generator's handling of the operationId field.
Patch Status
The fix is in orval 8.29.0. The references list a fix commit (b28c53f), pull request #4008, and GitHub Security Advisory GHSA-vv88-cm6j-665j.
Required action: Upgrade orval to 8.29.0 or later. Because the injected code sits in generated output, you should also regenerate any TanStack Query client code that an affected version produced. CISA has not issued a KEV required action, since the CVE is not currently listed in the catalog.