CVE-2026-96759— orval before 8.29.0 Code Injection via operationId

一分钟漏洞结论

复制摘要 复制引用

影响对象

orval-labs orval

利用判断

尚无明确在野利用证据，仍需结合暴露面评估

建议动作

优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。

orval before 8.29.0 fails to escape the operationId parameter when emitting it into generated TanStack Query mutator options metadata objects. Attackers can inject arbitrary JavaScript code through a crafted operationId in an OpenAPI specification that execute

CVE-2026-96759 影响 orval-labs orval。尚无明确在野利用证据，仍需结合暴露面评估。orval before 8.29.0 fails to escape the operationId parameter when emitting it into generated TanStack Query mutator options metadata objects. Attackers can inject arbitrary JavaSc CVE-2026-96759 漏洞详情，神龙漏洞库，https://cve.imfht.com/detail/CVE-2026-96759

一、 漏洞 CVE-2026-96759 基础信息

受影响产品

二、漏洞 CVE-2026-96759 的公开POC

三、漏洞 CVE-2026-96759 的情报信息

CVE-2026-96759 其他参考 (5)

• fix: escape operationId in query/mutation mutator options (GHSA-vv88-… · orval-labs/orval@b28c53f · GitHub patch
• fix: escape operationId in query/mutation mutator options (GHSA-vv88-… by melloware · Pull Request #4008 · orval-labs/orval patch issue-tracking
• 🔗 GitHub - orval-labs/orval: orval is able to generate client with appropriate type-signatures (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification, either in yaml or json formats. 🍺 · GitHub product
• Code injection via unescaped operationId in query/mutation mutator-options object literal · Advisory · orval-labs/orval · GitHub vendor-advisory
• 🔗 orval before 8.29.0 Code Injection via operationId | Advisories | VulnCheck third-party-advisory

• https://www.cve.org/CVERecord?id=CVE-2026-96759

同批安全公告 · orval-labs · 2026-09-23 · 共 6 条

IV. Related Vulnerabilities

V. Comments for CVE-2026-96759