CVE-2026-96756: Orval Code Injection RCE Vulnerability

CVE-2026-96756 Overview

CVE-2026-96756 is a code injection vulnerability in Orval, a TypeScript client generator for OpenAPI specifications. Versions of Orval before 8.30.0 fail to escape date default values inside generated new Date() calls within the @orval/core factory generator. Attackers can inject arbitrary JavaScript expressions through apostrophes in OpenAPI schema default values. When the factoryMethods and useDates options are enabled, the injected code executes with the privileges of the consumer process that runs the generated factories. The flaw is classified as improper control of code generation [CWE-94].

Critical Impact

A malicious OpenAPI schema can inject arbitrary JavaScript into generated factory files, leading to code execution in any process that imports them.

Affected Products

• Orval versions prior to 8.30.0
• @orval/core factory generator module
• Projects consuming factories generated with factoryMethods and useDates enabled

Discovery Timeline

• 2026-09-23 - CVE-2026-96756 published to the National Vulnerability Database
• 2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-96756

Vulnerability Analysis

Orval generates TypeScript factory functions from OpenAPI schemas. The factory generator in packages/core/src/generators/factory.ts emits new Date('<default_value>') expressions when a schema property is typed as a date and the useDates option is set. The generator embeds the raw default string directly into the emitted source without escaping single quotes or other JavaScript-significant characters.

An attacker who controls an OpenAPI specification, either by supplying it directly or by compromising an upstream schema source, can set a date default containing an apostrophe followed by arbitrary expressions. The generated code then contains attacker-controlled JavaScript that runs whenever the factory module is imported or invoked. Execution occurs with the privileges of the consumer process, which is commonly a developer workstation, a continuous integration runner, or a test harness.

Root Cause

The root cause is a missing string-literal escape when building generated source. The pre-patch code interpolated the OpenAPI default value directly into a template literal wrapped in single quotes. No sanitization function converted embedded quotes, backslashes, or line terminators into safe JavaScript escape sequences before the string was written to disk.

Attack Vector

Exploitation requires the target to run Orval against an attacker-influenced OpenAPI document with both factoryMethods and useDates enabled. Typical vectors include pulling a specification from an untrusted registry, generating clients from a third-party API description, or processing a specification submitted through an automated pipeline. The vulnerability is exploitable over the network because OpenAPI documents are commonly fetched by URL.

// Patch excerpt from packages/core/src/generators/factory.ts
   getFileInfo,
   getSchemasImportPath,
   isString,
+  jsStringLiteralEscape,
   logWarning,
   pascal,
   upath,

Source: Orval commit b9b0835. The fix imports a jsStringLiteralEscape helper and applies it to date defaults before they are written into generated new Date() calls.

Detection Methods for CVE-2026-96756

Indicators of Compromise

• Generated factory files containing new Date('...') expressions with embedded single quotes, backticks, or concatenation operators.
• Unexpected child processes, outbound network connections, or filesystem writes originating from Node.js processes running Orval-generated code.
• OpenAPI specifications with default fields on date properties that contain non-date characters such as ', );, or require(.

Detection Strategies

• Scan generated output directories for JavaScript or TypeScript files where interpolated date literals break out of their enclosing quotes.
• Enumerate package.json and lockfiles across repositories to identify Orval versions below 8.30.0.
• Diff generated factories before and after regeneration to flag unexpected expressions introduced by schema changes.

Monitoring Recommendations

• Monitor continuous integration runners for anomalous process execution during client generation or test runs.
• Log all fetches of external OpenAPI specifications and record the resolved URL, hash, and requesting pipeline.
• Alert on developer endpoints spawning shells, package managers, or network utilities from Node.js processes tied to build tooling.

How to Mitigate CVE-2026-96756

Immediate Actions Required

• Upgrade Orval and @orval/core to version 8.30.0 or later across all projects and pipelines.
• Regenerate all client code produced by earlier Orval versions and review the diff for injected expressions.
• Restrict client generation to OpenAPI specifications originating from trusted, integrity-verified sources.

Patch Information

The fix is delivered in Orval 8.30.0 through pull request #4038 and commit b9b0835. Additional context is available in GitHub Security Advisory GHSA-wx66-36r6-v5g7 and the VulnCheck advisory.

Workarounds

• Disable the factoryMethods option in the Orval configuration until upgrade is possible.
• Disable the useDates option so date properties do not trigger new Date() generation.
• Pre-process OpenAPI specifications to strip or validate default values on date-typed properties before generation.

# Upgrade Orval to the patched release
npm install --save-dev orval@^8.30.0

# Verify installed version
npm ls orval