Skip to content
Threat Feed
Subscribe

CPE

Cpe:2.3:a:orval:orval:*:*:*:*:*:*:*:*

2 briefs RSS
critical advisory

Code Injection Vulnerability in Orval @orval/effect Generator

Versions 8.14.0 through 8.28.1 of Orval contain a code injection vulnerability allowing arbitrary JavaScript execution via malicious OpenAPI schema defaults.

orval +1 supply-chain code-injection vulnerability
2t 1c
critical advisory

Remote Code Execution in Orval via Malicious Zod Schema Generation

Orval versions prior to 8.21.0 are vulnerable to remote code execution during module import due to improper sanitization of OpenAPI query parameter default values in generated Zod schemas.

Orval supply-chain rce nodejs typescript
1t 5c updated