---
id: CVE-2026-96754
title: >-
  orval versions before 8.29.0 contain a code injection vulnerability in the
  @orval/hono generator that fails to escape OpenAPI path values in
  single-quoted route literals
summary: >-
  orval versions before 8.29.0 contain a code injection vulnerability in the
  @orval/hono generator that fails to escape OpenAPI path values in
  single-quoted route literals. Attackers can craft an OpenAPI document with an
  apostrophe in a st…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-94
vendor: orval-labs
product: orval
affected:
  - orval < 8.29.0
published: '2026-09-23'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T21:08:55.030'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-96754'
references:
  - url: 'https://github.com/orval-labs/orval'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/orval-labs/orval/blob/v8.28.1/packages/hono/src/index.ts#L169-L175
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/orval-labs/orval/commit/155a5b7a38ff6886020cbc4c292db57c2793e6b6
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/orval-labs/orval/commit/d346d94a660e50a2f8d0f7c17fee2c4c69d8dc23
    label: disclosure@vulncheck.com
  - url: 'https://github.com/orval-labs/orval/pull/4006'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/orval-labs/orval/security/advisories/GHSA-g4mf-q5hw-f9j9
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/orval-orval-hono-before-8.29.0-code-injection-via-openapi-path
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
epss: 0.00427
epssPercentile: 0.34293
ingestedAt: '2026-09-23T17:28:14.857Z'
---

## Overview

orval versions before 8.29.0 contain a code injection vulnerability in the @orval/hono generator that fails to escape OpenAPI path values in single-quoted route literals. Attackers can craft an OpenAPI document with an apostrophe in a static path segment to inject arbitrary JavaScript code that executes when the generated TypeScript module is imported.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.