CVE-2026-96757
orval before 8.29.0 fails to escape OpenAPI media-type keys when emitting them into single-quoted Content-Type string literals in generated code. Attackers can inject JavaScript through crafted media-type keys in OpenAPI specifications that executes when generated fetch operations or mock resolvers are invoked.
취약점 유형
orval before 8.29.0 fails to escape OpenAPI media-type keys when emitting them into single-quoted Content-Type string literals in generated code. Attackers can inject JavaScript through crafted media-type keys in OpenAPI specifications that executes when generated fetch operations or mock resolvers are invoked.
참고 자료
- https://github.com/orval-labs/orval
- https://github.com/orval-labs/orval/blob/v8.28.1/packages/fetch/src/index.ts#L584
- https://github.com/orval-labs/orval/commit/43af282d62dca0ef3140023741fb768f6a718adb
- https://github.com/orval-labs/orval/commit/a2d4af59f3b167dc8a7a65d15f51cdb89ebe2fe5
- https://github.com/orval-labs/orval/pull/4007
- https://github.com/orval-labs/orval/security/advisories/GHSA-4q3x-rqfw-3x8p
공격자보다 먼저 취약점을 찾으세요.
GitHub로 로그인하고 1분 안에 첫 감사를 실행하세요. 무료 플랜은 신용카드가 필요 없습니다.