---
id: CVE-2026-96756
title: >-
  orval versions before 8.30.0 contain a code injection vulnerability in the
  @orval/core factory generator that fails to escape date default values in new
  Date() calls
summary: >-
  orval versions before 8.30.0 contain a code injection vulnerability in the
  @orval/core factory generator that fails to escape date default values in new
  Date() calls. Attackers can inject arbitrary expressions through apostrophes
  in Open…
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-94
vendor: orval-labs
product: orval
affected:
  - orval < 8.30.0
published: '2026-09-23'
updated: '2026-09-23'
sourceUpdated: '2026-09-23T20:17:27.057'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-96756'
references:
  - url: 'https://github.com/orval-labs/orval'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/orval-labs/orval/blob/v8.29.0/packages/core/src/generators/factory.ts#L493
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/orval-labs/orval/commit/b9b083576943c683540200eb957feced57dddc1a
    label: disclosure@vulncheck.com
  - url: 'https://github.com/orval-labs/orval/pull/4038'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/orval-labs/orval/security/advisories/GHSA-wx66-36r6-v5g7
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/orval-before-8.30.0-code-injection-via-factory-generation
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-23T18:11:23.190187Z'
ingestedAt: '2026-09-23T17:28:14.857Z'
epss: 0.00482
epssPercentile: 0.38913
---

## Overview

orval versions before 8.30.0 contain a code injection vulnerability in the @orval/core factory generator that fails to escape date default values in new Date() calls. Attackers can inject arbitrary expressions through apostrophes in OpenAPI schema defaults to execute code with the privileges of the consumer process when factoryMethods and useDates options are enabled.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.