CRITICALVulnerability
Verified
Global

NVD CRITICAL: CVE-2026-96758 — orval @orval/core before 8.28.0 contains a code injection vulnerability in the f...

·Source: NIST NVD

Updated:

Executive Summary

orval @orval/core before 8.28.0 contains a code injection vulnerability in the form-data serializer that fails to escape multipart property names in generated template literals. Attackers can inject ${...} expressions into OpenAPI schema property names that execute as live interpolation when the generated client builds FormData bodies with consumer process privileges.

Analysis

orval @orval/core before 8.28.0 contains a code injection vulnerability in the form-data serializer that fails to escape multipart property names in generated template literals. Attackers can inject ${...} expressions into OpenAPI schema property names that execute as live interpolation when the generated client builds FormData bodies with consumer process privileges. CVSS Score: 9.8. Published: 2026-09-23T17:17:25.083.

Indicators of Compromise (1)

CVE (1)
CVE-2026-96758
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Sep 23, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerability

Capitolis agrees $200m eSecLending acquisition

Capital markets technology provider Capitolis has added securities lending capabilities to its platform through a $200 million all-cash deal to buy eSecLending.

Finextra
MEDIUMVulnerability

Citi launches multi-market instant payments on Swift scheme

Citi has gone live with multiple markets on the Swift payments scheme, enabling bank clients to access multiple cross-border instant payment markets through a single account structure.

Finextra
MEDIUMVulnerability

Zilch eyes 2027 London IPO

Zilch is in talks with banks as it prepares to go public, with the UK-based buy now, pay later provider reportedly leaning towards a London listing.

Finextra