Is CVE-2026-96757 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-96757?

CVE-2026-96757 has a CVSS v3 severity of CRITICAL (9.8).

Back

CVE-2026-96757

Description

orval before 8.29.0 fails to escape OpenAPI media-type keys when emitting them into single-quoted Content-Type string literals in generated code. Attackers can inject JavaScript through crafted media-type keys in OpenAPI specifications that executes when generated fetch operations or mock resolvers are invoked.