CVE-2026-96755: Orval Code Injection RCE Vulnerability

CVE-2026-96755 Overview

CVE-2026-96755 is a code injection vulnerability [CWE-94] in Orval, an OpenAPI client generator maintained by Orval Labs. The flaw affects orval versions 8.14.0 through 8.28.1 and resides in the @orval/effect generator. The generator converts OpenAPI schema default values into JavaScript template literals without sanitization. Attackers can embed ${...} expressions inside schema defaults that execute at module scope when the generated code is built or imported.

Critical Impact

Arbitrary JavaScript execution during build or module import, enabling supply-chain compromise of developer machines and CI/CD pipelines that process attacker-controlled OpenAPI documents.

Affected Products

• orval version 8.14.0
• orval versions 8.15.0 through 8.28.0
• orval version 8.28.1

Discovery Timeline

• 2026-09-23 - CVE CVE-2026-96755 published to NVD
• 2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-96755

Vulnerability Analysis

Orval generates typed client code from OpenAPI specifications. The @orval/effect package emits Effect Schema definitions and copies schema default values directly into template literal expressions in the generated TypeScript source. Because JavaScript template literals evaluate any ${...} substitution as an expression, unsanitized defaults become executable code. The generated module runs the injected expression the first time it is imported or built, giving the attacker execution inside the developer or CI/CD process.

The attack surface extends beyond direct API design. Any workflow that feeds third-party OpenAPI documents into Orval, including automated client regeneration from upstream specs, becomes a code execution sink.

Root Cause

The generator in packages/effect/src/index.ts interpolates schema default values into a template literal without escaping backticks, backslashes, or the ${ sequence. The fix introduces a jsStringLiteralEscape helper that sanitizes OpenAPI document values before they are spliced into generated code.

Attack Vector

An attacker publishes or supplies an OpenAPI document containing a schema default value such as ${process.mainModule.require('child_process').execSync('id')}. When a downstream project runs orval to regenerate its client and then builds or imports the generated module, the template literal is evaluated and the payload executes with the privileges of the build process.

// Patch excerpt: packages/hono/src/index.ts (also applied to @orval/effect)
   isObject,
   isOperationInTagBucket,
   jsDoc,
+  jsStringLiteralEscape,
   logWarning,
   type NormalizedMutator,
   type NormalizedOutputOptions,

Source: Orval Labs Commit d346d94. The commit adds a jsStringLiteralEscape utility invoked wherever OpenAPI values are spliced into generated code, neutralizing ${...}, backtick, and backslash sequences.

Detection Methods for CVE-2026-96755

Indicators of Compromise

• Generated Orval output files containing template literal expressions with ${ sequences inside default value strings.
• Unexpected child processes such as sh, bash, node, or curl spawned by node, tsc, vite, webpack, or next build during client generation.
• Outbound network connections initiated by build tooling to unfamiliar hosts immediately after running orval.

Detection Strategies

• Scan repositories for orval versions between 8.14.0 and 8.28.1 in package.json and lockfiles.
• Grep Orval-generated files for suspicious template substitutions such as ${require(, ${process., or ${global..
• Review OpenAPI source documents for schema default fields containing ${, backticks, or backslash-escaped sequences.

Monitoring Recommendations

• Instrument CI/CD runners to log process trees during dependency install and code generation steps.
• Alert on outbound network activity from build agents that occurs outside of registry or artifact endpoints.
• Track integrity of generated client code by diffing outputs across builds to surface unexpected expression evaluation.

How to Mitigate CVE-2026-96755

Immediate Actions Required

• Upgrade orval to a version later than 8.28.1 that includes the jsStringLiteralEscape fix from pull request #3995.
• Audit CI/CD pipelines that ingest third-party OpenAPI documents and pause automated client regeneration until upgraded.
• Rotate credentials and tokens exposed to build environments that processed untrusted OpenAPI specs.

Patch Information

Orval Labs published the fix in commit d346d94 via pull request #3995. Details are documented in the GitHub Security Advisory GHSA-q7f2-jg6j-r867 and the VulnCheck Advisory for Orval.

Workarounds

• Restrict Orval input to trusted, internally authored OpenAPI documents until the patched release is deployed.
• Pre-process third-party OpenAPI specs to strip or escape ${, backtick, and backslash characters in default fields.
• Run orval and downstream builds inside an isolated, network-restricted container with no persistent credentials.

# Upgrade Orval to a fixed release
npm install --save-dev orval@latest

# Verify installed version is above 8.28.1
npm ls orval