CVE-2026-96755 is a code injection flaw in the @orval/effect generator of orval, rated 9.8. A crafted default value in an OpenAPI schema can end up as live code in the generated module and run when it is built or imported. Upgrade orval to 8.29.0 or later.
What's affected
- Package: orval on npm, the OpenAPI client generator, when it uses the effect client (the @orval/effect package).
- Affected: the CVE record says 8.14.0 through 8.28.1. The GitHub advisory text says 8.27.0 and earlier, and VulnCheck says 8.14.0 up to but not including 8.29.0. Use the widest range to be safe.
- Fixed: 8.29.0 or later, per the GitHub advisory.
- Precondition: the project generates code with the effect client from an OpenAPI spec that someone else can influence.
How to check if you're exposed
List the orval packages in each project and see whether the effect client is configured:
npm ls orval @orval/effect
grep -rn "effect" orval.config.* 2>/dev/null
Anything from 8.14.0 up to but not including 8.29.0 that uses the effect client is in scope. Then ask where your specs come from. A spec you wrote and review yourself is a very different risk from one pulled from a vendor, a partner, or a public URL.
What to do now
- Upgrade orval and its @orval/* packages to 8.29.0 or later, and commit the updated lock file.
- Regenerate your client code after upgrading, so any output produced by the old version is replaced.
- Treat specs from outside your team as untrusted input. Review default values in them before generation, and pin or vendor the specs you depend on.
- Run generation in CI with minimal secrets and no production credentials in the environment.
- If you generated code from a spec you did not trust, review the generated files, and rotate secrets that were available to the build or to developers who imported the output.
Why it matters
The record lists CWE-94, improper control of generation of code. The advisory explains the cause at a high level. The generator wrote a schema default into a JavaScript template literal, and its escaping did not cover the characters that make a template literal evaluate expressions. The same pattern had already been fixed in the zod generator of the same project, but the newer effect generator did not get that fix.
The detail that matters for defenders is when the code runs. It sits at the top level of a generated module, so it runs as soon as the module is built or imported, on a developer machine or in CI. That makes build pipelines and developer laptops the exposed systems, not production servers. The record does not mark this CVE as exploited in the wild, and this post does not reproduce any payload.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Am I affected if I use orval but not the effect client?
The advisory says the effect client is the precondition. Other generators are not described as affected, but upgrading is still cheap, so do it.
Why do the affected ranges differ between sources?
The CVE record and VulnCheck go up to 8.28.1, while the GitHub advisory text lists 8.27.0. Both agree that 8.29.0 contains the fix, so target 8.29.0 or later.
Sources
- GitHub advisory GHSA-q7f2-jg6j-r867
- VulnCheck advisory for orval @orval/effect
- Gold entry for CVE-2026-96755
Last reviewed: 19 October 2026.
