Skip to main content
cve.nowby Sazabi
← npm
npmPackage

orval

12 known vulnerabilities (11 critical, 1 high), with the versions each affects and the releases that fix them.

Latest release
8.47.0 (Nov 7, 2026): no advisory affects it
Newest unaffected release
8.47.0 (Nov 7, 2026), the latest release
Advisories
12 · 11 critical, 1 high
Weekly downloads
3.6M
Dependents
14
Releases
333 since 1.0.0 (Jan 11, 2020)
Registry
npm
Releases read
Nov 8, 2026

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 12

  • Orval: Generation-time SSRF + remote/local file inclusion via unrestricted $ref

    Affected: fixed in 8.22.0.

    Fixed in 8.22.0 (released Jul 14, 2026, 36 days before disclosure).

    The latest release, 8.47.0, is not affected.

    35% of orval downloads last week were affected versions (1.3M).

  • CVE-2026-62682Critical 9.3

    Orval: RCE via servers[].url -> unescaped request-URL template literal (with getBaseUrlFromSpecification)

    Affected: fixed in 8.21.0.

    Fixed in 8.21.0 (released Jul 12, 2026, 38 days before disclosure).

    The latest release, 8.47.0, is not affected.

    33% of orval downloads last week were affected versions (1.3M).

  • CVE-2026-72717Critical 9.3

    Orval: Import-time RCE via schema default -> zod module-level template literal

    Affected: fixed in 8.21.0.

    Fixed in 8.21.0 (released Jul 12, 2026, 38 days before disclosure).

    The latest release, 8.47.0, is not affected.

    33% of orval downloads last week were affected versions (1.3M).

  • CVE-2026-71867Critical 9.3

    Orval: RCE via schema property name -> computed-property-key injection in the MSW mock generator

    Affected: fixed in 8.21.0.

    Fixed in 8.21.0 (released Jul 12, 2026, 38 days before disclosure).

    The latest release, 8.47.0, is not affected.

    33% of orval downloads last week were affected versions (1.3M).

  • CVE-2026-71868Critical 9.3

    Orval: Import-time RCE via enum-typed default -> zod module-level template literal

    Affected: fixed in 8.21.0.

    Fixed in 8.21.0 (released Jul 12, 2026, 38 days before disclosure).

    The latest release, 8.47.0, is not affected.

    33% of orval downloads last week were affected versions (1.3M).

  • CVE-2026-71865Critical 9.3

    Orval: Import-time RCE via query parameter name -> computed-property-key injection in the zod cli

    Affected: fixed in 8.21.0.

    Fixed in 8.21.0 (released Jul 12, 2026, 38 days before disclosure).

    The latest release, 8.47.0, is not affected.

    33% of orval downloads last week were affected versions (1.3M).

  • CVE-2026-71869Critical 9.3

    Orval: Import-time RCE via array-items default -> zod module-level template literal

    Affected: fixed in 8.21.0.

    Fixed in 8.21.0 (released Jul 12, 2026, 38 days before disclosure).

    The latest release, 8.47.0, is not affected.

    33% of orval downloads last week were affected versions (1.3M).

  • CVE-2026-71864Critical 9.3

    Orval: Import-time RCE via header parameter name -> computed-property-key injection in the zod client

    Affected: fixed in 8.21.0.

    Fixed in 8.21.0 (released Jul 12, 2026, 38 days before disclosure).

    The latest release, 8.47.0, is not affected.

    33% of orval downloads last week were affected versions (1.3M).

  • CVE-2026-71871Critical 9.3

    Orval: Import-time RCE via header-parameter default -> zod module-level template literal

    Affected: fixed in 8.21.0.

    Fixed in 8.21.0 (released Jul 12, 2026, 38 days before disclosure).

    The latest release, 8.47.0, is not affected.

    33% of orval downloads last week were affected versions (1.3M).

  • CVE-2026-72716Critical 9.3

    Orval: Import-time RCE via query-parameter default -> zod module-level template literal

    Affected: fixed in 8.21.0.

    Fixed in 8.21.0 (released Jul 12, 2026, 38 days before disclosure).

    The latest release, 8.47.0, is not affected.

    33% of orval downloads last week were affected versions (1.3M).

  • CVE-2026-62681Critical 9.3

    Orval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout)

    Affected: fixed in 8.21.0.

    Fixed in 8.21.0 (released Jul 12, 2026, 38 days before disclosure).

    The latest release, 8.47.0, is not affected.

    33% of orval downloads last week were affected versions (1.3M).

  • CVE-2026-71866Critical 9.3

    Orval: Import-time RCE via schema property name -> computed-property-key injection in the zod client

    Affected: fixed in 8.21.0.

    Fixed in 8.21.0 (released Jul 12, 2026, 38 days before disclosure).

    The latest release, 8.47.0, is not affected.

    33% of orval downloads last week were affected versions (1.3M).