Is CVE-2026-96756 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-96756 being exploited in the wild.

How severe is CVE-2026-96756?

High severity, with a CVSS score of 8.1, published 23 September 2026.

Which products and versions are affected?

Orval Labs Orval before 8.30.0.

Is there a fix for CVE-2026-96756?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-96756 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-96756?

Check whether you run Orval Labs Orval at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-96756: orval code injection in factory generator date handling

CVE-2026-96756 · Severity: high · CVSS 8.1 · Published 2026-09-23

orval is a code generator that creates TypeScript API clients from OpenAPI specifications. When using the factory generator with date handling enabled, the tool fails to safely escape user-provided default values from API schemas, allowing an attacker to inject malicious code. An attacker controlling an OpenAPI schema could execute arbitrary code on developers' machines during the code generation process.

Technologies: Orval Labs Orval. Vendors: Orval Labs.

Quick answers

Is CVE-2026-96756 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-96756 being exploited in the wild.
How severe is CVE-2026-96756?: High severity, with a CVSS score of 8.1, published 23 September 2026.
Which products and versions are affected?: Orval Labs Orval before 8.30.0.
Is there a fix for CVE-2026-96756?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-96756 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-96756?: Check whether you run Orval Labs Orval at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The @orval/core factory generator contains an input validation flaw in date default value handling that does not properly escape apostrophes and special characters in OpenAPI schema default values before embedding them in generated new Date() calls. An attacker can inject arbitrary JavaScript expressions through crafted default values when the factoryMethods and useDates options are both enabled. The generated code executes with the privileges of the consuming process.

Affected products

orval-labs orval before 8.30.0

Timeline

2026-09-23: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.