Raw vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-24132 is a high-severity Command Injection (CWE-77) vulnerability in Orval Orval. Its CVSS base score is 7.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Command and Scripting Interpreter (T1059); ranked in the top 50% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-24132 is a code injection vulnerability in Orval, a tool that generates type-safe JavaScript/TypeScript clients from OpenAPI v3 or Swagger v2 specifications. Affected versions include 7.19.0 and earlier, as well as 8.0.0-rc.0 through 8.0.2. The flaw occurs when untrusted OpenAPI specifications use the "const" keyword on schema properties, allowing arbitrary TypeScript/JavaScript to be injected into generated mock files. These values are interpolated without proper escaping or serialization in the mock scalar generator (getMockScalar in packages/mock/src/faker/getters/scalar.ts), leading to attacker-controlled code in interface definitions and faker/MSW handlers. The issue is rated CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-77 (Command Injection) and CWE-94 (Code Injection).
Attackers can exploit this by supplying a malicious OpenAPI specification to any user or system running vulnerable Orval versions during code generation. No privileges or user interaction are required, enabling remote exploitation over the network. Successful injection results in arbitrary code execution within the generated mock files, potentially compromising development environments, CI/CD pipelines, or applications that load and use these mocks. The impact mirrors a prior issue with enum x-enumDescriptions (GHSA-h526-wf6g-67jv) but targets a distinct code path in the faker-based mock generator.
Mitigation involves updating to Orval versions 7.20.0 or 8.0.3, where the issue is fixed. Relevant patches are detailed in GitHub commits 44ca8c1f5f930a3e4cefb6b79b38bcde7f8532a5, 6d8ece07ccb80693ad43edabccb3957aceadcd06, and 9b211cddc9f009f8a671e4ac6cb72cd8646b62, along with pull requests 2828 and 2829.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-3783
Vulnerability Data
Orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification. Versions 7.19.0 and below and 8.0.0-rc.0 through 8.0.2 allow untrusted OpenAPI specifications to inject arbitrary TypeScript/JavaScript into generated mock files via the const keyword on…
more
schema properties. These const values are interpolated into the mock scalar generator (getMockScalar in packages/mock/src/faker/getters/scalar.ts) without proper escaping or type-safe serialization, which results in attacker-controlled code being emitted into both interface definitions and faker/MSW handlers. The vulnerability is similar in impact to the previously reported enum x-enumDescriptions (GHSA-h526-wf6g-67jv), but it affects a different code path in the faker-based mock generator rather than @orval/core. The issue has been fixed in versions 7.20.0 and 8.0.3.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V1.2.3V1.2.5V1.2.8V1.2.9
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation can discover command-construction flaws before deployment.
Input validation directly stops construction of commands from untrusted data containing special elements.
Least privilege limits the damage an injected code fragment can perform once executed.
Requiring documented secure development standards and tools enforces use of safe code-generation APIs and escaping.
Secure engineering principles include proper neutralization and safe command construction practices.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require input validation and neutralization that prevent command injection.
Runtime monitoring of software and data can detect anomalous command execution resulting from injection.
Identifying recorded vulnerabilities enables remediation of command-injection flaws before exploitation.
PR.DS-10 protects runtime data confidentiality/integrity but has no bearing on neutralizing externally influenced input during code generation, so neither direction shows any preventive effect.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure coding standards require proper escaping and parameterization of commands, directly eliminating CWE-77.
Security testing in development catches command-injection vulnerabilities before release.
Secure development life cycle mandates input validation and command construction practices that directly prevent command injection.
Application security requirements explicitly call for controls against injection flaws including command injection.
Secure architecture principles reduce the attack surface but do not prescribe the specific neutralization techniques needed.