CVE-2026-22785 is a critical injection flaw (CVSS 9.8) in orval, the OpenAPI client generator, before version 7.18.0. Its MCP server generation puts the OpenAPI summary field into code without escaping, so a crafted spec can inject code. The fix is orval 7.18.0, so upgrade.
What's affected
orval before 7.18.0. The fixed version is 7.18.0.
The flaw is in the MCP server generation logic, which builds code by string manipulation and includes the summary field from the OpenAPI specification.
How to check if you're exposed
Check which orval version your projects resolve.
npm ls orval
Run it in each repository, and look at lockfiles for pinned versions below 7.18.0. Also note whether you use the MCP generation feature, and where your OpenAPI specs come from.
What to do now
- Upgrade orval to 7.18.0 or later in every project and commit the lockfile.
- Regenerate any MCP server code that was produced from specs you did not write.
- Treat third party OpenAPI and Swagger files as untrusted input.
- Review generated code that comes from specs for unexpected statements before running it.
- Add a pull request check that fails the build on known vulnerable dependencies.
Why it matters
The weakness is CWE-77, improper neutralisation of special elements in a command, here a code generation template. The generator wraps the summary text in a string literal. If the text can close that literal, whatever follows becomes code in the generated file.
The vector shows a network source, low complexity, no privileges and high impact. The practical risk sits in the build step: a spec from outside your team is data, and the generator turns it into code that you then run. This is why the supply chain matters even for development tools.
The record does not say it is exploited in the wild, and it is not on the CISA KEV list. The fix is escaping or encoding the field before it enters generated code.
Try it yourself
A pull request gate is where an outdated orval version would be caught before it merges.
Click through it at your own pace, or open it full screen.
Quick check
Is this only a problem for MCP generation?
The record places the flaw in the MCP server generation logic. Upgrade anyway, since the fix is in 7.18.0.
Where do risky specs come from?
Any OpenAPI file you did not write, such as a partner spec or a downloaded sample.
Sources
Last reviewed: 19 October 2026.
