CVE-2026-24132 is a code injection flaw (CVSS 9.8) in Orval, the OpenAPI client generator. An untrusted OpenAPI spec can put code into generated mock files through the const keyword on schema properties. The affected range runs through 8.0.2. A fix was merged for the 8.0.3 milestone, so upgrade to 8.0.3 or later and confirm in the advisory.
What's affected
Orval 7.19.0 and below, and 8.0.0-rc.0 through 8.0.2, per the record. That means 8.0.2 itself is affected, unlike the earlier related issue CVE-2026-23947. The vulnerable code is the mock scalar generator in the faker mock package, which writes const values into interface definitions and faker and MSW handlers without escaping.
I could not confirm a fixed release number from the advisory text. The fix pull request (number 2828, titled to escape mocked values) was merged on 22 January 2026 and is labelled for the 8.0.3 milestone. Check the Orval advisory and releases and use the first version that lists the fix.
How to check if you're exposed
npm ls orval @orval/core @orval/mock
pnpm why orval
Then ask whether you generate mocks from OpenAPI specs, and where those specs come from. Only generation from third-party or user-supplied specs creates real exposure.
What to do now
- Upgrade Orval to 8.0.3 or later after confirming the fix in the advisory.
- Treat specs from outside your organization as untrusted input, and review them before generating code.
- Review generated mock files in pull requests after spec changes.
- If you cannot upgrade, stop generating mocks from untrusted specs.
- Run generation in CI without publishing credentials.
Why it matters
The record lists CWE-77 and CWE-94, injection of commands or code. The advisory notes similarity to an earlier issue in the enum description field. The same lesson repeats: a generator that writes values into source code has to escape or serialize every one of them, in every code path.
Fixing one field and leaving another is how a second and third report appear. Run the same escaping through a single function for all generated values. The record does not list this CVE as known exploited.
Reading the severity score
The record gives a CVSS base score of 9.8, published 2026-01-23. In the vector, the attacker works over the network, needs no account, and the attack is low in complexity. User interaction is not needed. Impact on confidentiality is high, on integrity high and on availability high.
A base score describes the flaw in general, not your risk. Weigh it against how exposed your instance is and what it can reach. The Gold page for the CVE keeps the score, weakness and references together.
Hardening beyond the patch
Generated code deserves the same review as code written by hand. Keep generated mocks in version control, review diffs when specs change, and run generators as an unprivileged user. If different tools in your pipeline turn specs into code, list them all, because this class of issue appears in each tool that writes values into source. Pin generator versions and update them on a schedule.
Find it across your own code
To see which of your packages are affected, the free in-browser dependency scan at gold.safeguard.sh/scan takes a manifest and lists known vulnerabilities. Reachability analysis then helps you judge whether your code calls the vulnerable path, so you can order the work.
Quick check
Is 8.0.2 safe?
For this issue, no. The record lists 8.0.2 in the affected range. Use a later release that the advisory confirms.
Sources
Last reviewed: 19 October 2026.
