CVE-2026-96757: Orval OpenAPI Generator XSS Vulnerability

CVE-2026-96757 Overview

CVE-2026-96757 is a code injection vulnerability in Orval, a TypeScript client generator that produces API code from OpenAPI specifications. Versions before 8.29.0 fail to escape OpenAPI media-type keys when emitting them into single-quoted Content-Type string literals in generated code. Attackers can inject arbitrary JavaScript through crafted media-type keys in an OpenAPI specification. The injected code executes when the generated fetch operations or mock resolvers are invoked. The flaw is tracked as CWE-94: Improper Control of Generation of Code.

Critical Impact
Malicious OpenAPI specifications can achieve arbitrary code execution inside applications built with Orval-generated clients, compromising confidentiality, integrity, and availability of the host process.

Affected Products

Orval (all versions before 8.29.0)
Orval @orval/fetch client generator
Orval @orval/angular HTTP client and HTTP resource generators

Discovery Timeline

2026-09-23 - CVE-2026-96757 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-96757

Vulnerability Analysis

Orval reads media-type keys from an OpenAPI document and interpolates them directly into TypeScript source it emits for fetch clients and Angular HTTP resources. The values are placed inside single-quoted Content-Type string literals without escaping embedded single quotes or other syntactically significant characters. A media-type key that contains a closing quote followed by JavaScript statements terminates the intended string literal and appends attacker-controlled code to the generated module.

When a developer runs Orval against a hostile or tampered specification, the resulting client module contains attacker code. That code executes as soon as the generated fetch operation or mock resolver is invoked at runtime, gaining the privileges of the host process.

Root Cause

The root cause is missing output escaping in the code generators. The affected emitters, including packages/fetch/src/index.ts and the Angular client and resource generators in packages/angular/src/, concatenated untrusted media-type keys into single-quoted literals. No call to a string-literal escape helper was performed before emission. The fix introduces a jsStringLiteralEscape helper across generators and disambiguates suffix collisions in packages/core/src/getters/body.ts.

Attack Vector

An attacker supplies an OpenAPI specification whose content object contains a media-type key crafted to break out of the generated single-quoted string. Delivery paths include public API catalogs, compromised registries, pull requests to repositories using Orval in continuous integration, and any workflow that generates clients from third-party specifications. Execution occurs on developer workstations, in CI runners, or in end-user applications, depending on where the generated code runs.

typescript

// Security patch: packages/angular/src/http-client.ts and http-resource.ts
// Introduces jsStringLiteralEscape helper for content type media keys
   type GetterProp,
   GetterPropType,
   isBoolean,
+  jsStringLiteralEscape,
   makeRouteSafe,
   pascal,
   toObjectString,
// Source: https://github.com/orval-labs/orval/commit/a2d4af59f3b167dc8a7a65d15f51cdb89ebe2fe5

typescript

// Security patch: packages/core/src/getters/body.ts
// Prevents suffix collisions after stripping unsafe characters
+  const usedSuffixes = new Set<string>();
+
   return filteredBodyTypes.map((bodyType) => {
-    const suffix = getContentTypeSuffix(bodyType.contentType);
+    const baseSuffix = getContentTypeSuffix(bodyType.contentType);
+    let suffix = baseSuffix;
+    for (let n = 2; usedSuffixes.has(suffix); n++) {
+      suffix = `${baseSuffix}${n}`;
+    }
+    usedSuffixes.add(suffix);
// Source: https://github.com/orval-labs/orval/commit/43af282d62dca0ef3140023741fb768f6a718adb

Detection Methods for CVE-2026-96757

Indicators of Compromise

Orval-generated TypeScript files whose Content-Type string literals contain unexpected characters, backticks, semicolons, or newline sequences.
OpenAPI documents with media-type keys containing single quotes, template literal delimiters, or JavaScript keywords such as require, process, or eval.
Unexpected outbound network connections or child process invocations originating from build tooling, CI runners, or applications shortly after client regeneration.

Detection Strategies

Scan repositories for package.json files declaring orval at versions below 8.29.0.
Diff newly generated Orval output against previous revisions and flag Content-Type literals that deviate from RFC 6838 media-type grammar.
Validate all OpenAPI specifications ingested by build pipelines against a strict media-type key regex, for example ^[A-Za-z0-9!#$&^_.+-]+/[A-Za-z0-9!#$&^_.+-]+$.

Monitoring Recommendations

Alert on process execution, file writes, or network egress from Node.js processes running Orval in CI.
Track dependency lockfile changes that upgrade or downgrade orval and require review for versions below 8.29.0.
Correlate application runtime telemetry with recent client regeneration events to surface newly introduced behaviors.

How to Mitigate CVE-2026-96757

Immediate Actions Required

Upgrade Orval to version 8.29.0 or later in every project, including transitive usage.
Regenerate all Orval client and mock code after upgrading and review the diff for injected content.
Treat OpenAPI specifications from untrusted sources as untrusted input and validate before code generation.
Rotate secrets accessible from environments where Orval executed against unverified specifications.

Patch Information

The issue is fixed in Orval 8.29.0. Relevant upstream references include Pull Request #4007, commit 43af282, commit a2d4af5, and the advisories GHSA-4q3x-rqfw-3x8p and GHSA-rcpr-mq4m-jx9j. Additional context is available in the VulnCheck advisory.

Workarounds

Restrict Orval execution to OpenAPI specifications from vetted, version-controlled sources.
Preprocess specifications to strip or reject media-type keys that do not match RFC 6838 grammar.
Run Orval in an isolated sandbox or ephemeral container with no access to production secrets or credentials.

bash

# Upgrade Orval to the patched release
npm install --save-dev orval@^8.29.0

# Verify the installed version
npx orval --version

# Regenerate clients and review the diff before committing
npx orval
git diff -- '**/generated/**'