Vulnerabilidades en orval-labs
22 resultadosCVE-2026-96756CRITICALorval before 8.30.0 Code Injection via Factory GenerationEPSS 0.9%CVE-2026-23947CRITICALOrval MCP client is vulnerable to code injection via unsanitized x-enum-descriptions in enum generationEPSS 0.8%CVE-2026-96757CRITICALorval before 8.29.0 Code Injection via unescaped OpenAPI media-typeEPSS 0.8%CVE-2026-96758CRITICALorval @orval/core before 8.28.0 Code Injection via Form-DataEPSS 0.8%CVE-2026-96755CRITICALorval @orval/effect 8.14.0 through 8.28.1 Code InjectionEPSS 0.8%CVE-2026-22785CRITICALorval MCP client is vulnerable to a code injection attack.EPSS 0.8%CVE-2026-24132HIGHOrval Mock Generation Code Injection via constEPSS 0.7%CVE-2026-25141CRITICALOrval has a code injection via unsanitized x-enum-descriptions uing JS commentsEPSS 0.7%CVE-2026-71865CRITICALOrval: Import-time RCE via query parameter name -> computed-property-key injection in the zod cliEPSS 0.7%CVE-2026-62682CRITICALOrval: RCE via servers[].url -> unescaped request-URL template literal (with getBaseUrlFromSpecification)EPSS 0.7%CVE-2026-71869CRITICALOrval: Import-time RCE via array-items default -> zod module-level template literalEPSS 0.7%CVE-2026-71864CRITICALOrval: Import-time RCE via header parameter name -> computed-property-key injection in the zod clientEPSS 0.7%CVE-2026-71867CRITICALOrval: RCE via schema property name -> computed-property-key injection in the MSW mock generatorEPSS 0.7%CVE-2026-71868CRITICALOrval: Import-time RCE via enum-typed default -> zod module-level template literalEPSS 0.7%CVE-2026-71866CRITICALOrval: Import-time RCE via schema property name -> computed-property-key injection in the zod clientEPSS 0.7%CVE-2026-62681CRITICALOrval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout)EPSS 0.7%CVE-2026-72717CRITICALOrval: Import-time RCE via schema default -> zod module-level template literalEPSS 0.7%CVE-2026-71871CRITICALOrval: Import-time RCE via header-parameter default -> zod module-level template literalEPSS 0.7%CVE-2026-72716CRITICALOrval: Import-time RCE via query-parameter default -> zod module-level template literalEPSS 0.7%CVE-2026-96754CRITICALorval @orval/hono before 8.29.0 Code Injection via OpenAPI PathEPSS 0.5%