PT-2026-2296 · Orval · Orval

Nirhaas · Published 2026-01-12 · Updated 2026-02-27 · CVE-2026-22785

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions orval versions prior to 7.18.0

Description orval generates type-safe JS clients (TypeScript) from OpenAPI specifications. Before version 7.18.0, the server generation logic in the MCP component used string manipulation on the summary field from the OpenAPI specification without sufficient validation or escaping. This allows for the injection of arbitrary code by exploiting a string literal breakout. The summary field is a part of the OpenAPI specification used to provide a brief description of an operation.

Recommendations Update to version 7.18.0 or later.

Exploit

Fix

RCE

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2026-22785

GHSA-MWR6-3GP8-9JMJ

Affected Products

Orval

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22785.json · Exploit
• https://github.com/orval-labs/orval/security/advisories/GHSA-mwr6-3gp8-9jmj · Vendor Advisory
• https://github.com/orval-labs/orval/commit/80b5fe73b94f120a3a5561952d6d4b0f8d7e928d · Patch
• https://osv.dev/vulnerability/GHSA-mwr6-3gp8-9jmj · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-22785 · Security Note
• https://osv.dev/vulnerability/CVE-2026-22785 · Vendor Advisory
• https://github.com/orval-labs/orval · Note
• https://twitter.com/_cvereports/status/2011229751633989665 · Twitter Post
• https://t.me/cveNotify/153564 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2010822176874607018 · Twitter Post
• https://twitter.com/pulsepatchio/status/2011448599897616605 · Twitter Post
• https://twitter.com/CVEnew/status/2010793676532761014 · Twitter Post
• https://twitter.com/0dayPublishing/status/2013698353381417207 · Twitter Post
• https://twitter.com/0dayPublishing/status/2010787881393037692 · Twitter Post
• https://t.me/cveNotify/149337 · Telegram Post