CVE-2026-96754— orval/hono 8.29.0前 OpenAPI路径代码注入漏洞

一分钟漏洞结论

复制摘要 复制引用

影响对象

orval-labs orval

利用判断

尚无明确在野利用证据，仍需结合暴露面评估

建议动作

优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。

orval versions before 8.29.0 contain a code injection vulnerability in the @orval/hono generator that fails to escape OpenAPI path values in single-quoted route literals. Attackers can craft an OpenAPI document with an apostrophe in a static path segment to in

CVE-2026-96754 影响 orval-labs orval。尚无明确在野利用证据，仍需结合暴露面评估。orval versions before 8.29.0 contain a code injection vulnerability in the @orval/hono generator that fails to escape OpenAPI path values in single-quoted route literals. Attackers CVE-2026-96754 漏洞详情，神龙漏洞库，https://cve.imfht.com/detail/CVE-2026-96754

一、 漏洞 CVE-2026-96754 基础信息

受影响产品

二、漏洞 CVE-2026-96754 的公开POC

三、漏洞 CVE-2026-96754 的情报信息

CVE-2026-96754 补丁与修复 (3)

• 🔗 fix: sanitize OpenAPI document values before splicing into generated … · orval-labs/orval@d346d94 · GitHub 查看完整文章 patch
• 🔗 fix: escape single quotes in generated route literals (GHSA-g4mf-q5hw… · orval-labs/orval@155a5b7 · GitHub 查看完整文章 patch
• 🔗 fix: escape single quotes in generated route literals (GHSA-g4mf-q5hw… by melloware · Pull Request #4006 · orval-labs/orval 查看完整文章 patch issue-tracking

CVE-2026-96754 其他参考 (3)

• 🔗 GitHub - orval-labs/orval: orval is able to generate client with appropriate type-signatures (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification, either in yaml or json formats. 🍺 · GitHub product
• 🔗 @orval/hono: Unescaped single-quote injection in generateHonoRoute() and getContext() — broken TypeScript in generated files · Advisory · orval-labs/orval · GitHub 查看完整文章 vendor-advisory
• 🔗 orval @orval/hono before 8.29.0 Code Injection via OpenAPI Path | Advisories | VulnCheck third-party-advisory

• https://www.cve.org/CVERecord?id=CVE-2026-96754

同批安全公告 · orval-labs · 2026-09-23 · 共 6 条

IV. Related Vulnerabilities

V. Comments for CVE-2026-96754