PT-2026-2296 · Orval · Orval

Nirhaas · Publicado 2026-01-12 · Atualizado 2026-02-27 · CVE-2026-22785

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions orval versions prior to 7.18.0

Description orval generates type-safe JS clients (TypeScript) from OpenAPI specifications. Before version 7.18.0, the server generation logic in the MCP component used string manipulation on the summary field from the OpenAPI specification without sufficient validation or escaping. This allows for the injection of arbitrary code by exploiting a string literal breakout. The summary field is a part of the OpenAPI specification used to provide a brief description of an operation.

Recommendations Update to version 7.18.0 or later.

Exploit

Correção

RCE

Command Injection

Enumeração de Fraquezas

CWE-77

Identificadores relacionados

CVE-2026-22785

GHSA-MWR6-3GP8-9JMJ

Produtos afetados

Orval

Referências · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22785.json · Exploit
• https://github.com/orval-labs/orval/security/advisories/GHSA-mwr6-3gp8-9jmj · Aviso do Fabricante
• https://github.com/orval-labs/orval/commit/80b5fe73b94f120a3a5561952d6d4b0f8d7e928d · Correção
• https://github.com/orval-labs/orval · Nota
• https://twitter.com/_cvereports/status/2011229751633989665 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-mwr6-3gp8-9jmj · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-22785 · Nota de Segurança
• https://t.me/cveNotify/153564 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/2010822176874607018 · Publicação no Twitter
• https://twitter.com/pulsepatchio/status/2011448599897616605 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-22785 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2010793676532761014 · Publicação no Twitter
• https://twitter.com/0dayPublishing/status/2013698353381417207 · Publicação no Twitter
• https://twitter.com/0dayPublishing/status/2010787881393037692 · Publicação no Twitter
• https://t.me/cveNotify/149337 · Publicação no Telegram