CRITICAL 9.3 NVD
CVE-2026-96759
orval before 8.29.0 fails to escape the operationId parameter when emitting it into generated TanStack Query mutator options metadata objects. Attackers can inj
orval before 8.29.0 fails to escape the operationId parameter when emitting it into generated TanStack Query mutator options metadata objects. Attackers can inject arbitrary JavaScript code through a crafted operationId in an OpenAPI specification that executes when generated hooks are called.
References
- https://github.com/orval-labs/orval
- https://github.com/orval-labs/orval/blob/v8.28.1/packages/query/src/query-generator.ts#L78
- https://github.com/orval-labs/orval/commit/b28c53f3e0c06190e0f6ea136737e6316432448f
- https://github.com/orval-labs/orval/pull/4008
- https://github.com/orval-labs/orval/security/advisories/GHSA-vv88-cm6j-665j
This critical severity vulnerability with a CVSS score of 9.3 was published on 2026-09-23 via NVD.
Risk Timeline
CVE Disclosed2026-09-23 · -1 days ago
Remediation Resources
vulnfeed aggregates 12908 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.