Vulnerabilidades en orval-labs
16 resultadosAnálisis Vexday
A Orval Labs apresenta 4 vulnerabilidades catalogadas, com 3 delas classificadas como críticas, mas nenhuma sob exploração ativa no momento. A fraqueza dominante identificada é CWE-77 (Improper Neutralization of Special Elements), sugerindo problemas estruturais em validação de entrada. A ausência de publicações recentes indica que o risco atual não está em evolução aguda, reduzindo a urgência de mitigação imediata.
CVE-2026-23947CRITICALOrval MCP client is vulnerable to code injection via unsanitized x-enum-descriptions in enum generationEPSS 0.8%CVE-2026-22785CRITICALorval MCP client is vulnerable to a code injection attack.EPSS 0.8%CVE-2026-24132HIGHOrval Mock Generation Code Injection via constEPSS 0.7%CVE-2026-72717CRITICALOrval: Import-time RCE via schema default -> zod module-level template literalEPSS 0.7%CVE-2026-62681CRITICALOrval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout)EPSS 0.7%CVE-2026-72716CRITICALOrval: Import-time RCE via query-parameter default -> zod module-level template literalEPSS 0.7%CVE-2026-25141CRITICALOrval has a code injection via unsanitized x-enum-descriptions uing JS commentsEPSS 0.6%CVE-2026-62682CRITICALOrval: RCE via servers[].url -> unescaped request-URL template literal (with getBaseUrlFromSpecification)EPSS 0.6%CVE-2026-71868CRITICALOrval: Import-time RCE via enum-typed default -> zod module-level template literalEPSS 0.6%CVE-2026-71867CRITICALOrval: RCE via schema property name -> computed-property-key injection in the MSW mock generatorEPSS 0.6%CVE-2026-71869CRITICALOrval: Import-time RCE via array-items default -> zod module-level template literalEPSS 0.6%CVE-2026-71864CRITICALOrval: Import-time RCE via header parameter name -> computed-property-key injection in the zod clientEPSS 0.6%CVE-2026-71865CRITICALOrval: Import-time RCE via query parameter name -> computed-property-key injection in the zod cliEPSS 0.5%CVE-2026-71866CRITICALOrval: Import-time RCE via schema property name -> computed-property-key injection in the zod clientEPSS 0.5%CVE-2026-71871CRITICALOrval: Import-time RCE via header-parameter default -> zod module-level template literalEPSS 0.5%CVE-2026-62680HIGHOrval: Generation-time SSRF + remote/local file inclusion via unrestricted $refEPSS 0.3%