Quick answers
- Is CVE-2026-96759 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-96759 being exploited in the wild.
- How severe is CVE-2026-96759?
- Critical severity, with a CVSS score of 9.8, published 23 September 2026.
- Which products and versions are affected?
- Orval Labs Orval before 8.29.0.
- Is there a fix for CVE-2026-96759?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-96759 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-96759?
- Check whether you run Orval Labs Orval at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability exists in the query generator where operationId from OpenAPI specs is unsanitized and directly embedded into generated TanStack Query mutator options metadata objects. An attacker can craft a malicious OpenAPI specification with a specially formatted operationId containing JavaScript code that will be executed when the generated hooks are invoked. This is a template injection vulnerability requiring attacker control over the OpenAPI specification input.
Affected products
- orval-labs orval before 8.29.0
Timeline
- 2026-09-23: disclosed