CVE-2026-96759
CRITICALCVSS 9.8Description
orval before 8.29.0 fails to escape the operationId parameter when emitting it into generated TanStack Query mutator options metadata objects. Attackers can inject arbitrary JavaScript code through a crafted operationId in an OpenAPI specification that executes when generated hooks are called.
Timeline
Published:September 23rd, 2026 5:17 PM
Last modified:September 29th, 2026 2:16 AM
CVSS Scoring
CVSS v3: 9.8 (CRITICAL)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses (CWE)
References & Reports
Advisories, patches, and third-party reports
- https://github.com/orval-labs/orval
- https://github.com/orval-labs/orval/blob/v8.28.1/packages/query/src/query-generator.ts#L784
- https://github.com/orval-labs/orval/commit/b28c53f3e0c06190e0f6ea136737e6316432448f
- https://github.com/orval-labs/orval/pull/4008
- https://github.com/orval-labs/orval/security/advisories/GHSA-vv88-cm6j-665j
- https://www.vulncheck.com/advisories/orval-before-8.29.0-code-injection-via-operationid
- https://github.com/orval-labs/orval/security/advisories/GHSA-vv88-cm6j-665j
Source: NIST NVD · Data may lag official sources by up to one minute