# orval (npm) vulnerabilities 12 known vulnerabilities (11 critical, 1 high), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 8.47.0 (Nov 7, 2026): no advisory affects it - Newest unaffected release: 8.47.0 (Nov 7, 2026), the latest release - Weekly downloads: 3.6M - Dependents: 14 - Releases: 333 since 1.0.0 (Jan 11, 2020) - Registry: https://www.npmjs.com/package/orval - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-62680: 1.0.0 to 8.21.0 (8.22.0 is outside it) - CVE-2026-62682: 1.0.0 to 8.20.0 (8.21.0 is outside it) - CVE-2026-72717: 1.0.0 to 8.20.0 (8.21.0 is outside it) - CVE-2026-71867: 1.0.0 to 8.20.0 (8.21.0 is outside it) - CVE-2026-71868: 1.0.0 to 8.20.0 (8.21.0 is outside it) - CVE-2026-71865: 1.0.0 to 8.20.0 (8.21.0 is outside it) - CVE-2026-71869: 1.0.0 to 8.20.0 (8.21.0 is outside it) - CVE-2026-71864: 1.0.0 to 8.20.0 (8.21.0 is outside it) - CVE-2026-71871: 1.0.0 to 8.20.0 (8.21.0 is outside it) - CVE-2026-72716: 1.0.0 to 8.20.0 (8.21.0 is outside it) - CVE-2026-62681: 1.0.0 to 8.20.0 (8.21.0 is outside it) - CVE-2026-71866: 1.0.0 to 8.20.0 (8.21.0 is outside it) ## Advisories (12) ### [CVE-2026-62680](https://cve.now/CVE-2026-62680): Orval: Generation-time SSRF + remote/local file inclusion via unrestricted $ref - Severity: High 7.1 - Published: Aug 19, 2026 - Affected: fixed in 8.22.0. - Fixed in 8.22.0 (released Jul 14, 2026, 36 days before disclosure). - The latest release, 8.47.0, is not affected. - 35% of orval downloads last week were affected versions (1.3M). ### [CVE-2026-62682](https://cve.now/CVE-2026-62682): Orval: RCE via servers\[\].url -\> unescaped request-URL template literal (with getBaseUrlFromSpecification) - Severity: Critical 9.3 - Published: Aug 19, 2026 - Affected: fixed in 8.21.0. - Fixed in 8.21.0 (released Jul 12, 2026, 38 days before disclosure). - The latest release, 8.47.0, is not affected. - 33% of orval downloads last week were affected versions (1.3M). ### [CVE-2026-72717](https://cve.now/CVE-2026-72717): Orval: Import-time RCE via schema default -\> zod module-level template literal - Severity: Critical 9.3 - Published: Aug 19, 2026 - Affected: fixed in 8.21.0. - Fixed in 8.21.0 (released Jul 12, 2026, 38 days before disclosure). - The latest release, 8.47.0, is not affected. - 33% of orval downloads last week were affected versions (1.3M). ### [CVE-2026-71867](https://cve.now/CVE-2026-71867): Orval: RCE via schema property name -\> computed-property-key injection in the MSW mock generator - Severity: Critical 9.3 - Published: Aug 19, 2026 - Affected: fixed in 8.21.0. - Fixed in 8.21.0 (released Jul 12, 2026, 38 days before disclosure). - The latest release, 8.47.0, is not affected. - 33% of orval downloads last week were affected versions (1.3M). ### [CVE-2026-71868](https://cve.now/CVE-2026-71868): Orval: Import-time RCE via enum-typed default -\> zod module-level template literal - Severity: Critical 9.3 - Published: Aug 19, 2026 - Affected: fixed in 8.21.0. - Fixed in 8.21.0 (released Jul 12, 2026, 38 days before disclosure). - The latest release, 8.47.0, is not affected. - 33% of orval downloads last week were affected versions (1.3M). ### [CVE-2026-71865](https://cve.now/CVE-2026-71865): Orval: Import-time RCE via query parameter name -\> computed-property-key injection in the zod cli - Severity: Critical 9.3 - Published: Aug 19, 2026 - Affected: fixed in 8.21.0. - Fixed in 8.21.0 (released Jul 12, 2026, 38 days before disclosure). - The latest release, 8.47.0, is not affected. - 33% of orval downloads last week were affected versions (1.3M). ### [CVE-2026-71869](https://cve.now/CVE-2026-71869): Orval: Import-time RCE via array-items default -\> zod module-level template literal - Severity: Critical 9.3 - Published: Aug 19, 2026 - Affected: fixed in 8.21.0. - Fixed in 8.21.0 (released Jul 12, 2026, 38 days before disclosure). - The latest release, 8.47.0, is not affected. - 33% of orval downloads last week were affected versions (1.3M). ### [CVE-2026-71864](https://cve.now/CVE-2026-71864): Orval: Import-time RCE via header parameter name -\> computed-property-key injection in the zod client - Severity: Critical 9.3 - Published: Aug 19, 2026 - Affected: fixed in 8.21.0. - Fixed in 8.21.0 (released Jul 12, 2026, 38 days before disclosure). - The latest release, 8.47.0, is not affected. - 33% of orval downloads last week were affected versions (1.3M). ### [CVE-2026-71871](https://cve.now/CVE-2026-71871): Orval: Import-time RCE via header-parameter default -\> zod module-level template literal - Severity: Critical 9.3 - Published: Aug 19, 2026 - Affected: fixed in 8.21.0. - Fixed in 8.21.0 (released Jul 12, 2026, 38 days before disclosure). - The latest release, 8.47.0, is not affected. - 33% of orval downloads last week were affected versions (1.3M). ### [CVE-2026-72716](https://cve.now/CVE-2026-72716): Orval: Import-time RCE via query-parameter default -\> zod module-level template literal - Severity: Critical 9.3 - Published: Aug 19, 2026 - Affected: fixed in 8.21.0. - Fixed in 8.21.0 (released Jul 12, 2026, 38 days before disclosure). - The latest release, 8.47.0, is not affected. - 33% of orval downloads last week were affected versions (1.3M). ### [CVE-2026-62681](https://cve.now/CVE-2026-62681): Orval: RCE via OpenAPI path -\> unescaped request-URL template literal (backtick breakout) - Severity: Critical 9.3 - Published: Aug 19, 2026 - Affected: fixed in 8.21.0. - Fixed in 8.21.0 (released Jul 12, 2026, 38 days before disclosure). - The latest release, 8.47.0, is not affected. - 33% of orval downloads last week were affected versions (1.3M). ### [CVE-2026-71866](https://cve.now/CVE-2026-71866): Orval: Import-time RCE via schema property name -\> computed-property-key injection in the zod client - Severity: Critical 9.3 - Published: Aug 19, 2026 - Affected: fixed in 8.21.0. - Fixed in 8.21.0 (released Jul 12, 2026, 38 days before disclosure). - The latest release, 8.47.0, is not affected. - 33% of orval downloads last week were affected versions (1.3M). --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/npm/orval Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.