CVE-2026-96759: Orval XSS Vulnerability in TanStack Query

CVE-2026-96759 Overview

CVE-2026-96759 is a code injection vulnerability [CWE-94] in orval, an OpenAPI client code generator, affecting versions before 8.29.0. The tool fails to escape the operationId parameter when emitting it into generated TanStack Query mutator options metadata objects. Attackers can inject arbitrary JavaScript through a crafted operationId value in an OpenAPI specification. The injected code executes when the generated hooks are invoked by consuming applications. This turns a malicious or tampered OpenAPI schema into a supply-chain vector against any downstream project that regenerates its API client.

Critical Impact
A crafted OpenAPI specification can inject arbitrary JavaScript into generated client code, executing in the context of any application that consumes the generated TanStack Query hooks.

Affected Products

orval (npm package orval) versions prior to 8.29.0
Projects consuming TanStack Query mutator options generated by vulnerable orval versions
OpenAPI-driven client codebases that regenerate from untrusted or third-party specifications

Discovery Timeline

2026-09-23 - CVE-2026-96759 published to the National Vulnerability Database
2026-09-23 - Last updated in NVD database
Vendor fix landed in orval commit b28c53f and Pull Request #4008, tracked under GHSA-vv88-cm6j-665j

Technical Details for CVE-2026-96759

Vulnerability Analysis

orval generates TypeScript client code from OpenAPI specifications, including TanStack Query hooks and mutator option metadata. When emitting the metadata object, the generator interpolates the OpenAPI operationId field directly into the produced source without string escaping. Any characters that terminate the JavaScript string literal, such as quotes or backticks, allow an attacker to break out of the intended context and append arbitrary expressions. The resulting generated file is valid TypeScript that executes attacker-controlled code the moment the hook is called at runtime. Because the injection sits inside build-time output, standard runtime input validation in the consuming application does not intercept it.

Root Cause

The root cause is unsanitized string interpolation of the operationId value in the query and mutation generators (packages/query/src/query-generator.ts and packages/query/src/mutation-generator.ts). No escaping helper was applied when constructing the mutator options metadata literal, so any string-terminating character in operationId alters the syntactic structure of the emitted code.

Attack Vector

An attacker supplies a malicious OpenAPI specification, either by publishing a tampered schema, compromising an upstream API definition, or submitting one through a workflow that regenerates orval clients. When a developer or CI pipeline runs orval against that spec, the injected JavaScript is written into the generated client. Execution occurs in the environment that later imports and invokes the generated hooks, typically a browser or Node.js process.

typescript

// Security patch in packages/query/src/query-generator.ts
// fix: escape operationId in query/mutation mutator options (GHSA-vv88-cm6j-665j)
  QueryType,
  requiresUserSuppliedQueryOptions,
} from './query-options';
-import { getHasSignal, shouldUseOptionsHook } from './utils';
+import {
+  getHasSignal,
+  getOperationMetaLiteral,
+  shouldUseOptionsHook,
+} from './utils';

/**
 * Decide whether the current operation's configuration conflicts with a

Source: orval commit b28c53f

The companion change in mutation-generator.ts imports the same getOperationMetaLiteral helper, which produces a safely escaped JavaScript string literal instead of raw interpolation.

Detection Methods for CVE-2026-96759

Indicators of Compromise

Generated orval output files containing unexpected quote characters, template literal terminators, or inline expressions inside mutator options metadata objects
OpenAPI specifications with operationId values containing quotes, backticks, backslashes, ${ sequences, or newline characters
Unexplained outbound network calls or child process spawns originating from client applications shortly after invoking a generated TanStack Query hook
Presence of orval versions earlier than 8.29.0 in package.json or package-lock.json

Detection Strategies

Scan repositories and CI artifacts for orval versions below 8.29.0 using software composition analysis tools
Diff regenerated client code against previous commits and flag changes inside mutator options metadata literals
Lint OpenAPI specifications to reject operationId values that contain non-identifier characters as required by the OpenAPI specification
Review generated files for JavaScript syntax that appears in string positions but is not a plain string literal

Monitoring Recommendations

Monitor CI/CD build logs for orval invocations against externally sourced OpenAPI documents
Track dependency updates in build systems and alert when orval remains pinned to a version below 8.29.0
Review commit history for changes to operationId fields in vendored or third-party OpenAPI specs

How to Mitigate CVE-2026-96759

Immediate Actions Required

Upgrade orval to version 8.29.0 or later across all projects and CI pipelines
Regenerate all client code produced by vulnerable orval versions and review the diff for injected expressions
Validate every operationId in ingested OpenAPI specifications against the OpenAPI-mandated pattern of alphanumerics and underscores
Treat third-party OpenAPI documents as untrusted input and gate their use behind schema validation in CI

Patch Information

The fix is delivered in orval 8.29.0 via commit b28c53f and Pull Request #4008. The patch introduces a getOperationMetaLiteral helper that safely encodes the operationId value before it is emitted into mutator options metadata. Full advisory context is available in GHSA-vv88-cm6j-665j and the VulnCheck advisory.

Workarounds

Restrict orval execution to OpenAPI specifications produced and controlled internally until the upgrade is complete
Pre-process OpenAPI documents to strip or reject operationId values containing characters outside [A-Za-z0-9_]
Run orval and any regenerated code review in isolated CI containers without production credentials

bash

# Upgrade orval to the patched release
npm install --save-dev orval@^8.29.0

# Verify the installed version is 8.29.0 or later
npm ls orval

# Regenerate client code and inspect the diff for injected expressions
npx orval --config ./orval.config.ts
git diff -- 'src/generated/**'