orval CVE-2026-96754 through 96759: Six Code Injection Flaws in Generated TypeScript Code

TL;DR — 90 seconds

orval generates TypeScript clients, React Query hooks, and mock data from OpenAPI specifications. Six new CVEs show the same pattern across six different generators: path segments, media-type keys, property names, operationId values, and date defaults from the specification land unescaped in string or template literals of the generated code. If one of these values contains a quote character or a ${} sequence, it can break out of the literal. The injected code runs as soon as someone imports the generated file or calls the generated function, not only at request runtime. Fix versions range from 8.28.0 to 8.30.0 depending on the CVE. Updating to 8.30.0 or later closes all six flaws at once.

What is the problem?

orval reads OpenAPI or Swagger documents and generates TypeScript types, fetch or Axios clients, React Query or SWR hooks, MSW mocks, and other artifacts from them. The six flaws share a common pattern: values originating from the specification are inserted unescaped directly into string literals or template literals of the generated code.

CVE-2026-96754 affects the @orval/hono generator: path values from the specification land unescaped in single-quoted route literals; an apostrophe in the path breaks out of the literal.

CVE-2026-96755 affects the @orval/effect generator: schema defaults are unsafely converted into template literals; a ${...} sequence in a default value leads to code execution on import or code construction.

CVE-2026-96756 affects the factory generator in @orval/core: when both factoryMethods and useDates are enabled, date defaults are inserted unescaped into new Date() calls.

CVE-2026-96757 affects the fetch generator in @orval/core: media-type keys from the specification are inserted unescaped into single-quoted Content-Type literals.

CVE-2026-96758 affects the form-data serializer in @orval/core: multipart property names land unescaped in template literals that execute while building the FormData body.

CVE-2026-96759 affects the TanStack Query generator: the operationId parameter is inserted unescaped into generated mutator-options metadata objects.

In all six cases, a crafted OpenAPI specification is enough as input. Anyone generating specifications from sources that are not fully trusted, such as partners or automatically fetched third-party APIs, is directly affected.

Who is affected?

Since the fix versions range from 8.28.0 to 8.30.0, only an update to 8.30.0 or later closes all six flaws at once. You're affected if you use any of the listed generators; most projects using orval for TypeScript client or hook generation use at least one of them.

Impact

The injected code runs in the context of the process that imports or executes the generated file, typically a build step, a CI job, or a Node.js runtime with filesystem and network access. Since orval usually runs during the build or a code-generation step with access to the repository, secrets, and CI environment variables, successful exploitation effectively amounts to remote code execution in the build pipeline.

For teams that source OpenAPI specifications from external partners, third-party APIs, or automatically from a backend they don't fully control, the risk is immediate: a manipulated specification is enough, and no interaction with the running application is required.

Mitigation / immediate actions

Update orval to version 8.30.0 or later to close all six flaws:

# Update the entire orval ecosystem
npm install orval@^8.30.0 --save-dev

# If individual packages are referenced directly
npm install @orval/core@^8.30.0 @orval/hono@^8.30.0 @orval/effect@^8.30.0 --save-dev

# Regenerate the generated code afterwards
npx orval --config ./orval.config.ts

Review already-generated code for suspicious patterns, especially apostrophes, backticks, or ${ sequences in paths, property names, or operationId values from the last generation run before the update. Commit freshly generated code after the update instead of relying on cached build artifacts.

Until the update is applied, run orval only against specifications from trusted, version-controlled sources, and avoid feeding runtime-downloaded or third-party specifications directly into it.

Detection / verification

Review your OpenAPI specifications and the most recently generated code for anomalies:

# Look for suspicious characters in paths, property names, and operationId values
grep -E "['\"\`]|\$\{" openapi.yaml openapi.json

# Check generated code for unusual expressions inside string context
grep -rn '${' generated/ --include='*.ts'

# Check CI logs for unexpected network connections or processes during the orval run
grep -i 'orval' ci-build.log

Also review which sources your OpenAPI specifications come from, and whether any of those sources could have been compromised or manipulated between disclosure and your last update.

Operator recommendation

Act today if: you run orval against OpenAPI specifications from sources that aren't fully trusted or are fetched automatically, especially inside a CI pipeline with access to secrets. Update to 8.30.0 or later immediately and regenerate the code.

Monitoring is enough if: you run orval exclusively against self-maintained, version-controlled specifications in an isolated build environment. An update to 8.30.0 is still advisable, since the trustworthiness of specification sources can change over time.

Conclusion

The six orval CVEs point to a pattern that goes beyond orval itself: code generators that turn external data such as OpenAPI specifications into executable code need the same escaping discipline as any other code-injection attack surface. If you use orval or comparable generators, treat specification sources as input data, not as trusted configuration.

Sources

• OSV: CVE-2026-96754 (@orval/hono)
• OSV: CVE-2026-96755 (@orval/effect)
• OSV: CVE-2026-96756 (@orval/core Factory)
• OSV: CVE-2026-96757 (@orval/core Fetch)
• OSV: CVE-2026-96758 (@orval/core Form-Data)
• OSV: CVE-2026-96759 (TanStack Query generator)
• orval-labs/orval on GitHub