CVE-2026-96758 Overview
CVE-2026-96758 is a code injection vulnerability in the Orval @orval/core package before version 8.28.0. The flaw exists in the form-data serializer, which fails to escape multipart property names when generating template literals. Attackers can inject ${...} expressions into OpenAPI schema property names. These expressions execute as live JavaScript interpolation when the generated client builds FormData request bodies. Exploitation runs with the privileges of the consuming process, allowing arbitrary code execution inside applications that generate HTTP clients from attacker-influenced OpenAPI specifications.
Critical Impact
Attacker-controlled OpenAPI schemas trigger arbitrary code execution in generated Orval clients through unescaped template literal interpolation in multipart property names.
Affected Products
- Orval @orval/core versions prior to 8.28.0
- Generated TypeScript/JavaScript API clients using multipart form-data serialization
- Consumer applications that build FormData bodies via Orval-generated code
Discovery Timeline
- 2026-09-23 - CVE-2026-96758 published to NVD
- 2026-09-23 - Last updated in NVD database
Technical Details for CVE-2026-96758
Vulnerability Analysis
Orval is a code generator that produces HTTP clients and TypeScript types from OpenAPI specifications. The vulnerable path resides in the response and request type getters at packages/core/src/getters/res-req-types.ts. When the generator emits FormData construction code for multipart request bodies, it inlines OpenAPI property names directly into JavaScript template literals without escaping the ${ sequence.
Any consumer that runs orval against an untrusted or attacker-influenced OpenAPI document will therefore produce client code containing live JavaScript expressions. Those expressions execute the first time the client serializes a matching multipart request, running in the same process context as the caller. This is classified as CWE-94 (Improper Control of Generation of Code).
Root Cause
The generator constructs template literal strings that embed property names directly, for example `${propertyName}`, but does not sanitize $, {, }, or backtick characters within the property name. An OpenAPI property named x${process.mainModule.require('child_process').execSync('id')} is written verbatim into the generated source, transforming a string label into executable code at build time or runtime, depending on how the emitted template literal is later evaluated.
Attack Vector
The attack requires the victim to run Orval against an OpenAPI schema controlled or modified by the attacker. Typical scenarios include third-party API specifications ingested from public registries, upstream OpenAPI documents pulled during CI builds, or shared specifications from partner integrations. Once the compromised client is generated and imported, any invocation that triggers the multipart serializer executes the injected payload with the privileges of the Node.js or browser process. See the VulnCheck Advisory for Orval and GitHub Security Advisory GHSA-jwhm-6748-j6pq for the underlying analysis and the vulnerable line at res-req-types.ts#L808.
No verified proof-of-concept code has been published. Refer to the Orval Pull Request 3988 and the fix in Orval Commit 975a769 for exact reproduction context.
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2026-96758
Indicators of Compromise
- Generated Orval client files containing template literals with unexpected ${...} sequences inside FormData append calls.
- OpenAPI specifications with property names containing $, {, }, or backtick characters, particularly under multipart/form-data request bodies.
- CI build logs showing execution of orval against externally sourced OpenAPI documents prior to @orval/core 8.28.0.
Detection Strategies
- Perform static analysis of generated client output for template literal interpolations that do not correspond to expected variable names.
- Diff regenerated clients against the previous version to surface newly introduced expressions in multipart serialization code.
- Inventory Node.js dependency manifests for @orval/core versions below 8.28.0 across build agents and developer workstations.
Monitoring Recommendations
- Monitor CI/CD pipelines for child process, network, or filesystem activity originating from orval build steps.
- Alert on outbound connections initiated by Node.js processes during API client generation or first-run test suites.
- Track ingestion of third-party OpenAPI documents and require review before they reach code generation stages.
How to Mitigate CVE-2026-96758
Immediate Actions Required
- Upgrade @orval/core to version 8.28.0 or later across all projects and lockfiles.
- Regenerate all Orval client code after upgrading and review the diff for residual injected expressions.
- Audit historical OpenAPI inputs used with vulnerable versions for property names containing template literal metacharacters.
Patch Information
The maintainers addressed the issue in commit 975a769, merged via Pull Request 3988 and released in @orval/core 8.28.0. The fix escapes multipart property names before embedding them into generated template literals. See the GitHub Security Advisory GHSA-jwhm-6748-j6pq for the full advisory text.
Workarounds
- Restrict Orval execution to trusted, internally curated OpenAPI specifications until upgrade is complete.
- Pre-process OpenAPI documents to strip or reject property names containing $, {, }, or backtick characters.
- Isolate code generation steps in ephemeral, network-restricted CI containers to limit blast radius if a malicious spec is processed.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
