Your OpenAPI code generator runs the spec: 18 orval CVEs
Orval, a popular OpenAPI client generator, shipped 18 advisories in September — most critical, most import-time RCE. If you generate clients from someone else's spec, read this.
An OpenAPI spec is not a document. It is input to a program that writes code your build then executes. Orval — one of the most-used TypeScript client generators for OpenAPI — has spent September proving that the hard way. GitHub's advisory database now lists 22 advisories across orval packages. Eighteen of them landed this month, six on September 23 alone.
What actually happened
The September 23 batch is CVE-2026-96754 through CVE-2026-96759, all rated critical, spread across @orval/core, @orval/hono and @orval/effect. A seventh advisory the same day, GHSA-w4x4-mpp4-4854, carries a CVSS of 9.8: the factory generator converted numeric, integer and boolean enum members with bare string conversion instead of JSON encoding. Feed it an OpenAPI 3.1 document with a payload inside a numeric enum, turn on output.factoryMethods, and the payload lands in the generated TypeScript at module scope. It runs when the module is imported — before any function is called.
The pattern repeats across the month. An earlier critical, GHSA-6h9g-hcv4-66p6, interpolated schema names and required[] entries straight into single-quoted TypeScript type literals. Same result: injected statements that survive compilation and execute on import.
Orval's maintainers have been fast. npm shows six releases between September 12 and September 23, ending at 8.37.0 — the version that fixes the newest advisory. If you are below 8.37.0, you are behind at least one critical.
Why untrusted OpenAPI specs matter for your business
Nobody audits a YAML file. That is the whole problem. Your CI job pulls a partner's spec, regenerates a client, and the generated code gets imported by a test — inside a runner that holds your npm token, your cloud credentials and your artifact signing keys. The blast radius of a bad spec is your entire build environment.
Treat every third-party spec as executable input. A vendor's spec URL is a dependency with no lockfile. Snapshot it into your repo, diff it on change, and review the diff like code.
Do not regenerate clients in a job that holds secrets. Codegen needs a spec and a filesystem. It does not need your deploy credentials. Split the step.
Pin the generator and watch its advisories. Orval moved four minor versions in eleven days. Dependabot alerts on the generator are the only warning you get.
Key takeaways
- GitHub lists 22 advisories for orval packages; 18 were published in September 2026
- Six critical CVEs (CVE-2026-96754 – CVE-2026-96759) were published on September 23 alone
- The newest, GHSA-w4x4-mpp4-4854, is CVSS 9.8 and affects @orval/core at or below 8.36.0
- Upgrade to orval 8.37.0 or later, released September 23
- The recurring flaw is import-time code execution: a malicious spec becomes module-scope JavaScript
- Run codegen in a job with no deploy secrets, and snapshot third-party specs into your repo
Your build pipeline is part of your attack surface. We separate code generation from credentialed steps, pin and monitor generator dependencies, and make third-party specs reviewable instead of trusted. See how we harden build pipelines or have us audit yours.
Sources: GitHub Advisory Database, GHSA-w4x4-mpp4-4854, npm.
- #openapi
- #supply-chain
- #codegen
- #typescript
- #ci-cd
Tommy Rush — Founder, Rush Commerce
Operator turned builder. 15+ years running operations — now shipping the systems businesses run on. More
Get The Rush Report weekly — one email, zero fluff.
Keep reading
WordPress CVE-2026-87902 is being exploited. Patch today.
WordPress CVE-2026-87902 is a CVSS 9.2 unauthenticated path traversal that chains to RCE. Probing started hours after the patch. Now attackers are writing shells.
Read itGemini 4 is in post-training. Pin your model versions.
Google DeepMind says Gemini 4 has entered post-training and it wants an early release out much sooner than year-end. Plan for the swap before it lands in your stack.
Read it