Is CVE-2026-96758 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-96758?

CVE-2026-96758 has a CVSS v3 severity of CRITICAL (9.8).

Back

CVE-2026-96758

Description

orval @orval/core before 8.28.0 contains a code injection vulnerability in the form-data serializer that fails to escape multipart property names in generated template literals. Attackers can inject ${...} expressions into OpenAPI schema property names that execute as live interpolation when the generated client builds FormData bodies with consumer process privileges.