Code Injection Vulnerability in Orval @orval/effect Generator

Orval versions 8.14.0 through 8.28.1 are affected by a code injection vulnerability located within the @orval/effect generator component. The vulnerability exists because the generator improperly processes OpenAPI schema default values, directly converting them into template literals within the generated output files. An attacker capable of influencing the OpenAPI definition - such as through a compromised API specification source or a malicious pull request - can embed arbitrary JavaScript expressions using the ${...} syntax. These expressions are subsequently evaluated at module scope when the generated code is built by a bundler or imported into a Node.js or browser environment. This vulnerability enables remote code execution during the build process or runtime, posing a critical risk to CI/CD pipelines and downstream applications consuming the generated client libraries.

Impact

Successful exploitation allows for arbitrary code execution within the environment where the Orval-generated code is processed. This can lead to the compromise of CI/CD build environments, exfiltration of environment variables and secrets, or the injection of malicious code into the final application build. This vulnerability affects developers and organizations using Orval to generate client code from untrusted or externally sourced OpenAPI specifications.

Recommendation

• Upgrade the Orval package to a version beyond 8.28.1 immediately to resolve CVE-2026-96755.
• Audit all OpenAPI specification files currently being processed by Orval for any instances of ${...} syntax appearing within default values.
• Implement strict validation and sanitization for OpenAPI files sourced from untrusted external contributors or third-party repositories before processing them with Orval.