chore(deps): update dependency orval to v8 [security] - autoclosed

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
orval (source)	^7.21.0 → ^8.0.0

---

Orval: Import-time RCE via schema property name -> computed-property-key injection in the zod client

CVE-2026-71866 / GHSA-6mr6-jvcr-2f25

More information

Details

Summary

orval's zod client emits each schema property name as a double-quoted key in the generated zod.object({...})
WITHOUT escaping the double quote. A " in a property name closes the key and lands in object-literal
context, where an injected computed property key [expr] is evaluated when zod.object({...}) runs -- which
is at MODULE IMPORT (the export const X = zod.object({...}) executes on load) -> import-time RCE. The
property name is a pure data field. Verified on orval 8.19.0 / Node. CWE-94 / CWE-95 / CWE-116.

Details

export const OpBody = zod.object({ "a":zod.string(),[require("fs").writeFileSync("PWNED","")]:zod.string(),"b": zod.string().optional() })

Sibling: the MSW mock uses a single-quoted key (' breakout, call-time) -- separate report. The TS interface
key is a type (DoS only). Distinct from orval's $ref / route-path / server-url / zod-default findings.

PoC

reproduce.sh (+ make_spec.py) attached: a property name a":zod.string(),[require("fs").writeFileSync("","")]:zod.string(),"b
-> zod.object; evaluating it (= importing the module) writes the marker. Verified on 8.19.0.

Impact

JavaScript / OS command execution (via child_process) at import time for anyone who generates an orval zod
client from an attacker-controlled spec and imports it. Estimated Critical, e.g.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N.

Suggested fix

Escape the property name for the JS string key (JSON.stringify) in the zod.object key generation; never
interpolate a raw property name adjacent to [ ] in object-literal position.
maintainer-report.txt
make_spec.py
reproduce.sh

Severity

• CVSS Score: 9.3 / 10 (Critical)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/orval-labs/orval/security/advisories/GHSA-6mr6-jvcr-2f25
• https://nvd.nist.gov/vuln/detail/CVE-2026-71866
• https://github.com/orval-labs/orval/pull/3692
• https://github.com/orval-labs/orval/commit/8ef1bfdf3f9bcaf9dabfbe2e42887f1c0e159ab6
• https://github.com/orval-labs/orval/releases/tag/v8.21.0
• https://github.com/advisories/GHSA-6mr6-jvcr-2f25

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Orval: Import-time RCE via query-parameter default -> zod module-level template literal

CVE-2026-72716 / GHSA-p4cg-3328-rvfg

More information

Details

Summary

Orval's zod schema generation emits the query-parameter default value as a module-level template literal
(export const …Default = ;) without escaping ${ or the backtick. A default of the form
v${<code>}w injects a live JavaScript expression evaluated when the generated zod schema module is
imported, executing attacker-controlled code at import — no request or function call needed. Verified
on Orval 8.19.0; survives default OpenAPI validation.

Details

export const …Default = `v${globalThis.ORVPWN()}w`;   // ${...} = arbitrary JS expression, runs at import

Malicious input: a query parameter with a default of v${<attacker JS>}w. ${...} permits any JS expression.

Note: this is one of several default-bearing positions that reach the same unescaped zod
template-literal sink; a single fix (escape default values) closes all of them, and a CNA may choose
to consolidate the related reports.

PoC

reproduce.sh (+ make_spec.py) attached: generates the zod schema with default validation, bundles
it, imports it, and shows a marker written at import. Verified on 8.19.0.

Impact

Code execution at import in any application that imports a zod schema module generated from an
attacker-controlled or attacker-influenced OpenAPI description.

Suggested fix

Emit default values via a proper string-literal encoder (JSON.stringify, or escape backtick and ${
if a template literal must be used); never interpolate a spec value into a template literal. Apply to
every default position.
maintainer-report.txt
make_spec.py
reproduce.sh

Severity

• CVSS Score: 9.3 / 10 (Critical)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/orval-labs/orval/security/advisories/GHSA-p4cg-3328-rvfg
• https://nvd.nist.gov/vuln/detail/CVE-2026-72716
• https://github.com/orval-labs/orval/pull/3692
• https://github.com/orval-labs/orval/commit/8ef1bfdf3f9bcaf9dabfbe2e42887f1c0e159ab6
• https://github.com/orval-labs/orval/releases/tag/v8.21.0
• https://github.com/advisories/GHSA-p4cg-3328-rvfg

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Orval: Generation-time SSRF + remote/local file inclusion via unrestricted $ref

CVE-2026-62680 / GHSA-cxq5-97v7-87j8

More information

Details

Summary

Orval resolves OpenAPI $refs by fetching remote http(s) URLs and reading local files (including
absolute / out-of-tree paths), inlining the referenced schema into the generated client. Running
orval on a spec whose $ref points at an attacker/internal URL or an arbitrary local file yields
SSRF, remote file inclusion, and local file inclusion. Verified on 8.19.0. This is a different class
from Orval's published output-injection CVEs (CVE-2026-22785/23947/24132/25141), none of which covers
the $ref resolver.

Details

• $ref: http://attacker/internal-evil.json#/... → build host fetches (SSRF) and inlines the remote
  schema (RFI); confirmed property REMOTE_ORVAL_PROP in the generated client.
• $ref: /abs/path.json#/... or ../../secret.json#/... → out-of-tree local file read + inlined (LFI).

No RCE: on 8.19.0 the description JSDoc is escaped (*/->*\/, the published fix), so $ref content
cannot break out into code. The chain stops at SSRF + RFI + LFI.

Fix: don't resolve remote $refs by default (opt-in + host allowlist); confine local $ref
resolution to the input directory tree (reject absolute paths and ../ escapes).

PoC

reproduce.sh attached: confirms LFI (out-of-tree read), SSRF (listener hit), RFI (remote schema
inlined). Verified on Orval 8.19.0.

Impact

Build-time SSRF from the developer or CI host, disclosure of arbitrary local files, and inclusion of untrusted remote content, from running the generator on an attacker-controlled or attacker-influenced OpenAPI description. No code execution (output escaping is in place post the earlier fixes).

Severity

• CVSS Score: 7.1 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

References

• https://github.com/orval-labs/orval/security/advisories/GHSA-cxq5-97v7-87j8
• https://nvd.nist.gov/vuln/detail/CVE-2026-62680
• https://github.com/orval-labs/orval/pull/3692
• https://github.com/orval-labs/orval/pull/3723
• https://github.com/orval-labs/orval/commit/23786c056f4eba38c02bf2968677988dbbe4de10
• https://github.com/orval-labs/orval/commit/8ef1bfdf3f9bcaf9dabfbe2e42887f1c0e159ab6
• https://github.com/orval-labs/orval/releases/tag/v8.22.0
• https://github.com/advisories/GHSA-cxq5-97v7-87j8

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Orval: Import-time RCE via header parameter name -> computed-property-key injection in the zod client

CVE-2026-71864 / GHSA-6437-gxhq-pqv8

More information

Details

Summary

orval's zod client emits each header parameter name as a double-quoted key in the generated zod.object({...}) request-validation schema WITHOUT escaping the double quote. A " in the header parameter name closes the key and lands in object-literal context, where an injected computed property key [expr] is evaluated when zod.object({...}) runs -- at MODULE IMPORT (export const OpHeader = zod.object({...}) executes on load) -> import-time RCE. The header parameter name is a pure data field. Verified on orval 8.19.0 / Node.

Details

export const OpHeader = zod.object({ "a":zod.string(),[require("fs").writeFileSync("PWNED","")]:zod.string(),"b": ... })

Also affects the hono client (reuses zod generation). orval escapes values in zod arrays but not keys in zod.object. Sibling fields: schema property name, query parameter name (CVE-96) (separate reports). Distinct from orval's $ref / route-path / server-url / zod-default findings.

PoC

reproduce.sh (+ make_spec.py) attached: a header parameter name that breaks the zod.object key and injects a computed key; evaluating it (= importing the module) writes the marker. Verified on 8.19.0.

Impact

JavaScript / OS command execution at import time for anyone who generates an orval zod client from an attacker-controlled spec and imports it.

Suggested fix

Escape the header parameter name for the JS string key (JSON.stringify) in the zod.object key generation; never interpolate a raw name adjacent to [ ] in object-literal position.

Severity

• CVSS Score: 9.3 / 10 (Critical)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/orval-labs/orval/security/advisories/GHSA-6437-gxhq-pqv8
• https://nvd.nist.gov/vuln/detail/CVE-2026-71864
• https://github.com/orval-labs/orval/pull/3692
• https://github.com/orval-labs/orval/commit/8ef1bfdf3f9bcaf9dabfbe2e42887f1c0e159ab6
• https://github.com/orval-labs/orval/releases/tag/v8.21.0
• https://github.com/advisories/GHSA-6437-gxhq-pqv8

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Orval: Import-time RCE via query parameter name -> computed-property-key injection in the zod cli

CVE-2026-71865 / GHSA-653q-5476-x79g

More information

Details

Summary

orval's zod client emits each query parameter name as a double-quoted key in the generated zod.object({...}) request-validation schema WITHOUT escaping the double quote. A " in the query parameter name closes the key and lands in object-literal context, where an injected computed property key [expr] is evaluated when zod.object({...}) runs -- at MODULE IMPORT (export const OpQueryParams = zod.object({...}) executes on load) -> import-time RCE. The query parameter name is a pure data field. Verified on orval 8.19.0 / Node.

Details

export const OpQueryParams = zod.object({ "a":zod.string(),[require("fs").writeFileSync("PWNED","")]:zod.string(),"b": ... })

Also affects the hono client (reuses zod generation). orval escapes values in zod arrays but not keys in zod.object. Sibling fields: schema property name, header parameter name (CVE-97) (separate reports). Distinct from orval's $ref / route-path / server-url / zod-default findings.

PoC

reproduce.sh (+ make_spec.py) attached: a query parameter name that breaks the zod.object key and injects a computed key; evaluating it (= importing the module) writes the marker. Verified on 8.19.0.

Impact

JavaScript / OS command execution at import time for anyone who generates an orval zod client from an attacker-controlled spec and imports it.

Suggested fix

Escape the query parameter name for the JS string key (JSON.stringify) in the zod.object key generation; never interpolate a raw name adjacent to [ ] in object-literal position. maintainer-report.txt make_spec.py reproduce.sh

Severity

• CVSS Score: 9.3 / 10 (Critical)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/orval-labs/orval/security/advisories/GHSA-653q-5476-x79g
• https://nvd.nist.gov/vuln/detail/CVE-2026-71865
• https://github.com/orval-labs/orval/pull/3692
• https://github.com/orval-labs/orval/commit/8ef1bfdf3f9bcaf9dabfbe2e42887f1c0e159ab6
• https://github.com/orval-labs/orval/releases/tag/v8.21.0
• https://github.com/advisories/GHSA-653q-5476-x79g

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Orval: Import-time RCE via enum-typed default -> zod module-level template literal

CVE-2026-71868 / GHSA-3575-w9fc-c2j6

More information

Details

Summary

Orval's zod schema generation emits the enum-typed default value as a module-level template literal (export const …Default = ;) without escaping ${ or the backtick. A default of the form v${<code>}w injects a live JavaScript expression evaluated when the generated zod schema module is imported, executing attacker-controlled code at import — no request or function call needed. Verified on Orval 8.19.0; survives default OpenAPI validation.

Details

export const …Default = `v${globalThis.ORVPWN()}w`;   // ${...} = arbitrary JS expression, runs at import

Malicious input: an enum-typed property with a default of v${<attacker JS>}w. ${...} permits any JS expression.

Note: this is one of several default-bearing positions that reach the same unescaped zod template-literal sink; a single fix (escape default values) closes all of them, and a CNA may choose to consolidate the related reports.

PoC

reproduce.sh (+ make_spec.py) attached: generates the zod schema with default validation, bundles it, imports it, and shows a marker written at import. Verified on 8.19.0.

Impact

Code execution at import in any application that imports a zod schema module generated from an attacker-controlled or attacker-influenced OpenAPI description.

Suggested fix

Emit default values via a proper string-literal encoder (JSON.stringify, or escape backtick and ${ if a template literal must be used); never interpolate a spec value into a template literal. Apply to every default position.

Severity

• CVSS Score: 9.3 / 10 (Critical)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/orval-labs/orval/security/advisories/GHSA-3575-w9fc-c2j6
• https://nvd.nist.gov/vuln/detail/CVE-2026-71868
• https://github.com/orval-labs/orval/pull/3692
• https://github.com/orval-labs/orval/commit/8ef1bfdf3f9bcaf9dabfbe2e42887f1c0e159ab6
• https://github.com/orval-labs/orval/releases/tag/v8.21.0
• https://github.com/advisories/GHSA-3575-w9fc-c2j6

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Orval: RCE via schema property name -> computed-property-key injection in the MSW mock generator

CVE-2026-71867 / GHSA-2w86-xfrc-g85r

More information

Details

Summary

orval, when generating MSW mocks (output.mock: true), emits each schema property name as a single-quoted object key in the mock factory WITHOUT escaping the single quote. A ' in a property name closes the key and lands in object-literal context, where an injected computed property key [expr] is evaluated when the mock factory is called (e.g. in tests / MSW handlers) -> RCE. The property name is a pure data field. Verified on orval 8.19.0 / Node.

Details

export const getOpResponseMock = (...): Thing => ({'x': 0, [require("fs").writeFileSync("PWNED","")]: 0, 'y': faker...., ...overrideResponse});

Safe elsewhere: the zod schema double-quotes the property name; the TS interface key is a type (DoS only). Distinct from orval's $ref / route-path / server-url / zod-default findings.

PoC

reproduce.sh (+ make_spec.py) attached: a property name x': 0, [require("fs").writeFileSync("<marker>","")]: 0, 'y -> mock object literal; calling the mock factory writes the marker. Verified on 8.19.0.

Impact

JavaScript / OS command execution (via child_process) on the machine of anyone who generates orval mocks from an attacker controlled spec and runs them (tests / MSW).

Suggested fix

Escape the property name for the JS string key (JSON.stringify), and never interpolate a raw property name adjacent to [ ] in object-literal position.

Severity

• CVSS Score: 9.3 / 10 (Critical)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/orval-labs/orval/security/advisories/GHSA-2w86-xfrc-g85r
• https://nvd.nist.gov/vuln/detail/CVE-2026-71867
• https://github.com/orval-labs/orval/pull/3692
• https://github.com/orval-labs/orval/commit/8ef1bfdf3f9bcaf9dabfbe2e42887f1c0e159ab6
• https://github.com/orval-labs/orval/releases/tag/v8.21.0
• https://github.com/advisories/GHSA-2w86-xfrc-g85r

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Orval: Import-time RCE via header-parameter default -> zod module-level template literal

CVE-2026-71871 / GHSA-8j6p-r8jg-mxqh

More information

Details

Summary

Orval's zod schema generation emits the header-parameter default value as a module-level template literal (export const Default = ;) without escaping ${ or the backtick. A default of the form v${<code>}w injects a live JavaScript expression evaluated when the generated zod schema module is imported, executing attacker-controlled code at import — no request or function call needed. Verified on Orval 8.19.0; survives default OpenAPI validation.

Details

export const …Default = `v${globalThis.ORVPWN()}w`;   // ${...} = arbitrary JS expression, runs at import

Malicious input: a header parameter with a default of v${<attacker JS>}w. ${...} permits any JS expression.

Note: this is one of several default-bearing positions that reach the same unescaped zod template-literal sink; a single fix (escape default values) closes all of them, and a CNA may choose to consolidate the related reports.

PoC

reproduce.sh (+ make_spec.py) attached: generates the zod schema with default validation, bundles it, imports it, and shows a marker written at import. Verified on 8.19.0.

Impact

Code execution at import in any application that imports a zod schema module generated from an attacker-controlled or attacker-influenced OpenAPI description.

Suggested fix

Emit default values via a proper string-literal encoder (JSON.stringify, or escape backtick and ${ if a template literal must be used); never interpolate a spec value into a template literal. Apply to every default position. make_spec.py reproduce.sh

Severity

• CVSS Score: 9.3 / 10 (Critical)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/orval-labs/orval/security/advisories/GHSA-8j6p-r8jg-mxqh
• https://nvd.nist.gov/vuln/detail/CVE-2026-71871
• https://github.com/orval-labs/orval/pull/3692
• https://github.com/orval-labs/orval/commit/8ef1bfdf3f9bcaf9dabfbe2e42887f1c0e159ab6
• https://github.com/orval-labs/orval/releases/tag/v8.21.0
• https://github.com/advisories/GHSA-8j6p-r8jg-mxqh

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Orval: Import-time RCE via array-items default -> zod module-level template literal

CVE-2026-71869 / GHSA-2h9g-j24r-h63g

More information

Details

Summary

Orval's zod schema generation emits the array-items default value as a module-level template literal (export const …Default = ;) without escaping ${ or the backtick. A default of the form v${<code>}w injects a live JavaScript expression evaluated when the generated zod schema module is imported, executing attacker-controlled code at import — no request or function call needed. Verified on Orval 8.19.0; survives default OpenAPI validation.

Details

export const …Default = `v${globalThis.ORVPWN()}w`;   // ${...} = arbitrary JS expression, runs at import

Malicious input: an array property (string items) with a default of v${<attacker JS>}w. ${...} permits any JS expression.

Note: this is one of several default-bearing positions that reach the same unescaped zod template-literal sink; a single fix (escape default values) closes all of them, and a CNA may choose to consolidate the related reports.

PoC

reproduce.sh (+ make_spec.py) attached: generates the zod schema with default validation, bundles it, imports it, and shows a marker written at import. Verified on 8.19.0.

Impact

Code execution at import in any application that imports a zod schema module generated from an attacker-controlled or attacker-influenced OpenAPI description.

Suggested fix

Emit default values via a proper string-literal encoder (JSON.stringify, or escape backtick and ${ if a template literal must be used); never interpolate a spec value into a template literal. Apply to every default position. maintainer-report.txt make_spec.pyreproduce.sh

Severity

• CVSS Score: 9.3 / 10 (Critical)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/orval-labs/orval/security/advisories/GHSA-2h9g-j24r-h63g
• https://nvd.nist.gov/vuln/detail/CVE-2026-71869
• https://github.com/orval-labs/orval/pull/3692
• https://github.com/orval-labs/orval/commit/8ef1bfdf3f9bcaf9dabfbe2e42887f1c0e159ab6
• https://github.com/orval-labs/orval/releases/tag/v8.21.0
• https://github.com/advisories/GHSA-2h9g-j24r-h63g

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Orval: Import-time RCE via schema default -> zod module-level template literal

CVE-2026-72717 / GHSA-w727-8j6c-2rj4

More information

Details

Summary

Orval's zod schema generation emits a schema's default value as a module-level template literal (export const …Default = ;) without escaping ${ or the backtick. A default of the form v${<code>}w injects a live JavaScript expression that is evaluated when the generated zod schema module is imported, executing attacker-controlled code at import — no request or function call needed. Verified on Orval 8.19.0; survives default OpenAPI validation.

Details

export const getIResponseDsDefault = `v${globalThis.ORVPWN()}w`;

${...} permits an arbitrary JS expression. Orval escapes its other value sinks (enum, mock, regex, object-default values) with \' inside single-quoted strings; the string default is the one value emitted as a backtick template literal, so ${...}/backtick are interpreted, not escaped. Distinct from the URL-template-literal cases (different field and sink) and from the published Orval CVEs (summary/MCP, x-enumDescriptions, const/mock).

PoC

reproduce.sh (+ make_spec.py) attached: generates the zod schema with default validation, bundles it, imports it, and shows a marker written at import. Verified on 8.19.0.

Impact

Code execution at import in any application that imports a zod schema module generated from an attacker-controlled or attacker-influenced OpenAPI description.

Suggested fix

Emit default values via a proper string-literal encoder (JSON.stringify, or escape backtick and ${ if a template literal must be used); never interpolate a spec value into a template literal.

maintainer-report.txt
make_spec.py
reproduce.sh

Severity

• CVSS Score: 9.3 / 10 (Critical)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/orval-labs/orval/security/advisories/GHSA-w727-8j6c-2rj4
• https://nvd.nist.gov/vuln/detail/CVE-2026-72717
• https://github.com/orval-labs/orval/pull/3692
• https://github.com/orval-labs/orval/commit/8ef1bfdf3f9bcaf9dabfbe2e42887f1c0e159ab6
• https://github.com/orval-labs/orval/releases/tag/v8.21.0
• https://github.com/advisories/GHSA-w727-8j6c-2rj4

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Orval: RCE via servers[].url -> unescaped request-URL template literal (with getBaseUrlFromSpecification)

CVE-2026-62682 / GHSA-88f2-fpv8-89q2

More information

Details

Summary

When Orval is configured with output.baseUrl.getBaseUrlFromSpecification: true, it bakes the spec's servers[0].url into the generated request URL as a template literal without escaping the backtick. A server URL containing a backtick closes the template literal and injects a concatenation expression evaluated when the generated URL/request function is called, executing attacker-controlled code. Verified on Orval 8.19.0 (fetch client); survives default OpenAPI validation.

Details

return `http://api.x/` + (globalThis.X = require("fs").writeFileSync("/marker","pwned")) + `/v1/u`;

Prerequisite: the documented getBaseUrlFromSpecification: true option (takes the base URL from the OpenAPI servers block). This is the same output sink as the route-path case (request-URL template literal) reached via the server url field. Distinct from Orval's published CVEs (CVE-2026-22785 summary/MCP, CVE-2026-23947 / CVE-2026-25141 x-enumDescriptions, CVE-2026-24132 const/mock).

PoC

reproduce.sh (+ make_spec.py) attached: generates a fetch client with getBaseUrlFromSpecification: true, bundles it, calls the functions, and shows a marker written. Verified on 8.19.0.

Impact

With that option enabled, code execution in any environment that calls a client generated from an attacker-controlled or attacker-influenced OpenAPI description.

Suggested fix

Escape the server URL before emitting it into the URL template literal (escape backtick and ${), or build the base URL with an encoder that treats it as data; validate the URL.
maintainer-report.txt
make_spec.py
reproduce.sh

Severity

• CVSS Score: 9.3 / 10 (Critical)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/orval-labs/orval/security/advisories/GHSA-88f2-fpv8-89q2
• https://nvd.nist.gov/vuln/detail/CVE-2026-62682
• https://github.com/orval-labs/orval/pull/3692
• https://github.com/orval-labs/orval/commit/8ef1bfdf3f9bcaf9dabfbe2e42887f1c0e159ab6
• https://github.com/orval-labs/orval/releases/tag/v8.21.0
• https://github.com/advisories/GHSA-88f2-fpv8-89q2

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Orval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout)

CVE-2026-62681 / GHSA-fg9p-mrxr-hvq7

More information

Details

Summary

Orval emits the OpenAPI path into the generated request URL as a TEMPLATE LITERAL (`/users/...`) without escaping the backtick character. A path containing a backtick closes the template literal and injects a concatenation expression that is evaluated when the generated URL/request/key function is called, executing attacker-controlled code. Affects the axios, fetch, react-query, and swr clients. Verified on Orval 8.19.0; survives Orval's default OpenAPI validation.

Details

// generated URL builder (fetch client)
return `/users/` + (globalThis.X = require("fs").writeFileSync("/marker","pwned")) + `/list`;

The backtick in the path terminates the `...` literal; + (<code>) + runs as a live expression; a trailing backtick reopens a template literal so the file stays valid. The code runs whenever the generated request function, URL builder, or query-key function is called.

This is distinct from Orval's four published CVEs: CVE-2026-22785 (summary -> MCP server), CVE-2026-23947 / CVE-2026-25141 (x-enumDescriptions), and CVE-2026-24132 (const -> mock files). This is a different field (the route path) and a different sink (the request-URL template literal), which those advisories and their fixes do not cover.

PoC

reproduce.sh (+ make_spec.py) attached: generates a fetch client with default validation, bundles it, calls the generated functions, and shows a marker file written. Verified on 8.19.0.

Impact

Code execution in any environment that calls a client generated from an attacker-controlled or attacker-influenced OpenAPI description (developer, CI, or the running application).

Suggested fix

Escape the path before emitting it into the URL template literal (escape backtick and ${, or build the URL with an encoder that treats the path as data), and validate path characters.

Severity

• CVSS Score: 9.3 / 10 (Critical)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/orval-labs/orval/security/advisories/GHSA-fg9p-mrxr-hvq7
• https://nvd.nist.gov/vuln/detail/CVE-2026-62681
• https://github.com/orval-labs/orval/pull/3692
• https://github.com/orval-labs/orval/commit/8ef1bfdf3f9bcaf9dabfbe2e42887f1c0e159ab6
• https://github.com/orval-labs/orval/releases/tag/v8.21.0
• https://github.com/advisories/GHSA-fg9p-mrxr-hvq7

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

orval-labs/orval (orval)

v8.22.0

Compare Source

What's Changed

[!IMPORTANT]
Security Fix is a breaking change that now requires you to configure if you want refs to be external and not traverse directories etc. Please see the docs for how to use and override: https://orval.dev/docs/reference/configuration/input#externalrefs

• fix(core): skip Required for required keys missing from properties by @​Hypenate in #​3721
• fix(angular): send required nullable query params as empty string without a paramsSerializer by @​the-ult in #​3716
• fix(core): gate external $ref resolution behind explicit allow-list by @​aqeelat in #​3723
• Release v8.22.0 by @​github-actions[bot] in #​3725

Full Changelog: orval-labs/orval@v8.21.0...v8.22.0

v8.21.0

Compare Source

What's Changed

• fix(ci): trigger docker image publish on release by @​vondenstein in #​3687
• fix(mock): inline enum values in mocks for union enumGenerationType by @​wadakatu in #​3694
• fix(mock): generate tuple values for OpenAPI 3.1 prefixItems by @​wadakatu in #​3697
• feat: allow zod discriminatedUnion generation by @​titivermeesch in #​3698
• fix(core): only match import alias when detecting used dependencies by @​wadakatu in #​3699
• fix(security): escape spec-controlled strings in generated template literals and object keys by @​aqeelat in #​3692
• fix(axios): eliminate module-level returnTypesToWrite map by @​aqeelat in #​3696
• fix(angular): keep httpResource idle for absent optional request body (#​3700) by @​the-ult in #​3701
• fix(angular): read signals inside the httpResource factory for multi-content-type resources by @​the-ult in #​3715
• fix(mock): use exported element aliases for top-level array responses in arrayItems factories by @​the-ult in #​3709
• feat(core): allow operationName override to decouple type names from method names by @​aqeelat in #​3693
• fix(angular): serialize object query params per OpenAPI style/explode instead of dropping them by @​the-ult in #​3708
• feat(angular): expose request headers and HttpContext on generated httpResource helpers by @​the-ult in #​3717
• Release v8.21.0 by @​github-actions[bot] in #​3720

New Contributors

• @​vondenstein made their first contribution in #​3687

Full Changelog: orval-labs/orval@v8.20.0...v8.21.0

v8.20.0

Compare Source

What's Changed

• fix(zod): emit hoisted sub-models for recursive reusable schemas by @​Spence1115 in #​3652
• fix(fetch): respect OpenAPI default explode: true for array query parameters (#​3231) by @​zeriong in #​3308
• feat(core): support package mutator paths by @​chippleh1392 in #​3653
• feat(docker): add official CLI image and GHCR publish workflow by @​KuldeepGehlot in #​3654
• fix(core): restore Required for allOf required fields lost after normalizeAllOfSchema by @​Noyabronok in #​3655
• docs(clean): clarify clean wipes entire output dirs, not only generated files by @​aqeelat in #​3657
• perf(core): cache $dynamicAnchor fallback index on context by @​aqeelat in #​3659
• docs(output): restructure importPath validation and sync zh translation by @​aqeelat in #​3658
• fix(core): http verbs include OPTIONS by @​melloware in #​3661
• @​orval/mcp: no Zod input schema generated for application/x-www-form-urlencoded request bodies (#​3664) by @​yagop in #​3665
• Adds pkg.pr.new to publish PR preview versions by @​arthurfiorette in #​3668
• Add --bun to PR previews by @​arthurfiorette in #​3669
• Add support for zod/mini generation by @​arthurfiorette in #​3666
• fix(core): combine required from constraint-only allOf overlays by @​wadakatu in #​3674
• build(deps): bump docker/setup-buildx-action from 3 to 4 by @​dependabot[bot] in #​3670
• build(deps): bump docker/build-push-action from 6 to 7 by @​dependabot[bot] in #​3671
• build(deps): bump docker/setup-qemu-action from 3 to 4 by @​dependabot[bot] in #​3672
• build(deps): bump docker/login-action from 3 to 4 by @​dependabot[bot] in #​3673
• docs(zod): correct stale JSDoc left on parseBodyAndResponse by @​yagop in #​3678
• fix(core): support npm-aliased TypeScript versions by @​haydenholligan in #​3677
• fix(core): fix issue when barrel file was re-exporting itself (#​3675) by @​PowerSlime in #​3676
• feat(vue-query): use MaybeRefOrGetter/toValue for reactive params on v5 by @​daugvinasr in #​3679
• test: cover optional security alternatives by @​kriptoburak in #​3680
• fix(mock): register enum value imports from oneOf split mock helpers by @​johncarmack1984 in #​3681
• Release v8.20.0 by @​github-actions[bot] in #​3683

New Contributors

• @​KuldeepGehlot made their first contribution in #​3654
• @​PowerSlime made their first contribution in #​3676
• @​kriptoburak made their first contribution in #​3680
• @​johncarmack1984 made their first contribution in #​3681

Full Changelog: orval-labs/orval@v8.19.0...v8.20.0

v8.19.0

Compare Source

What's Changed

[!NOTE]
Zod v4 is now the default but you can change it to be v3 with a config change

• fix(zod): resolve inline $dynamicAnchor overrides in dynamic scope by @​aqeelat in #​3622
• fix(query): remove unused getHttpFunctionQueryProps by @​daugvinasr in #​3626
• fix: remove dead code and unused files by @​daugvinasr in #​3629
• fix(client): remove isVue from @orval/core by @​daugvinasr in #​3630
• fix(angular): keep httpResource response imports type-only by @​haydenholligan in #​3633
• build(angular): upgrade workspace to angular 22 by @​the-ult in #​3637
• feat(core): add tagsSplitDeduplication option for barrel + shared type extraction by @​aqeelat in #​3558
• refactor(query): route axios isVue flag through the framework adapter by @​daugvinasr in #​3631
• fix(angular): ensure schemas path uses directory path in httpResource split mode by @​the-ult in #​3638
• feat(fetch): add paramsSerializer and arrayFormat support for query params by @​ronderksen in #​3636
• fix(core,hono): generalize the #​3634 tag-identity fix and fix the same bug in hono by @​the-ult in #​3641
• feat(schemas): add splitByTags option to organize schemas by tag by @​aqeelat in #​3595
• build(deps): bump actions/checkout from 6 to 7 by @​dependabot[bot] in #​3646
• fix(core): recover schema-factory imports in single-mode mock writer by @​aqeelat in #​3648
• test(vue-query): align enabled-reactivity samples with #​3241 nullish semantics by @​the-ult in #​3647
• fix(query): avoid mutation operation name shadowing by @​haydenholligan in #​3644
• feat(zod): Make Zod 4 the workspace baseline by @​the-ult in #​3642
• feat(mock): add override.mock.schemas for per-schema property overrides by @​jakiestfu in #​3645
• Release v8.19.0 by @​github-actions[bot] in #​3649

New Contributors

• @​ronderksen made their first contribution in #​3636

Full Changelog: orval-labs/orval@v8.18.0...v8.19.0

v8.18.0

Compare Source

What's Changed

• fix(core): generate requiredNullableParamKeys only if preserveRequire… by @​jjfreez in #​3597
• fix(zod): resolve global zod mutators against output workspace by @​chippleh1392 in #​3598
• fix(mcp): order handler body/query args and propagate optional body to handler + tool schema by @​yagop in #​3600
• fix(query): resolve global query mutators against output workspace by @​chippleh1392 in #​3604
• fix(query): attach queryKey without spreading the react-query result by @​wadakatu in #​3605
• fix(core): use getImportExtension for NodeNext module resolution across all writers by @​aqeelat in #​3603
• feat(zod): coerce single-value array query params via opt-in coerce: ['array'] by @​NathanFichefet in #​3609
• fix(core): escape schema default values in stringify ([#​3583](https://redirect.github.com/orval-labs/orval

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (in timezone Europe/Madrid)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ✅ 0 package(s) with unknown licenses.
• ⚠️ 1 packages with OpenSSF Scorecard issues.

See the Details below.

OpenSSF Scorecard

Scorecard details

Package	Version	Score	Details
npm/orval	^8.0.0	Unknown	Unknown
npm/@commander-js/extra-typings	15.0.0	Unknown	Unknown
npm/@orval/angular	8.27.0	Unknown	Unknown
npm/@orval/axios	8.27.0	Unknown	Unknown
npm/@orval/core	8.27.0	Unknown	Unknown
npm/@orval/effect	8.27.0	Unknown	Unknown
npm/@orval/fetch	8.27.0	Unknown	Unknown
npm/@orval/hono	8.27.0	Unknown	Unknown
npm/@orval/mcp	8.27.0	Unknown	Unknown
npm/@orval/mock	8.27.0	Unknown	Unknown
npm/@orval/query	8.27.0	Unknown	Unknown
npm/@orval/solid-start	8.27.0	Unknown	Unknown
npm/@orval/swr	8.27.0	Unknown	Unknown
npm/@orval/zod	8.27.0	Unknown	Unknown
npm/@scalar/helpers	0.10.0	Unknown	Unknown
npm/@scalar/helpers	0.11.1	Unknown	Unknown
npm/@scalar/json-magic	0.12.20	Unknown	Unknown
npm/@scalar/json-magic	0.13.2	Unknown	Unknown
npm/@scalar/openapi-parser	0.28.16	Unknown	Unknown
npm/@scalar/openapi-types	0.9.4	Unknown	Unknown
npm/@scalar/openapi-types	0.9.5	Unknown	Unknown
npm/@scalar/openapi-upgrader	0.2.15	Unknown	Unknown
npm/@sec-ant/readable-stream	0.4.1	Unknown	Unknown
npm/@sindresorhus/merge-streams	4.0.0	🟢 4.1	Details Check Score Reason Maintained ⚠️ 0 0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0 Binary-Artifacts 🟢 10 no binaries found in the repo Security-Policy 🟢 10 security policy file detected Packaging ⚠️ -1 packaging workflow not detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Code-Review 🟢 6 Found 20/30 approved changesets -- score normalized to 6 Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
npm/commander	15.0.0	🟢 7.5	Details Check Score Reason Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Code-Review 🟢 9 Found 20/22 approved changesets -- score normalized to 9 Security-Policy 🟢 10 security policy file detected Packaging ⚠️ -1 packaging workflow not detected Maintained 🟢 9 1 commit(s) and 10 issue activity found in the last 90 days -- score normalized to 9 Token-Permissions 🟢 9 detected GitHub workflow tokens with excessive permissions Binary-Artifacts 🟢 10 no binaries found in the repo Pinned-Dependencies 🟢 10 all dependencies are pinned CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 10 license file detected Fuzzing ⚠️ 0 project is not fuzzed Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches Signed-Releases ⚠️ -1 no releases found SAST 🟢 8 SAST tool detected but not run on all commits
npm/execa	9.6.1	🟢 4.4	Details Check Score Reason Code-Review ⚠️ 2 Found 6/30 approved changesets -- score normalized to 2 Packaging ⚠️ -1 packaging workflow not detected Security-Policy 🟢 9 security policy file detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Maintained 🟢 10 24 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Binary-Artifacts 🟢 8 binaries present in source code Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 License 🟢 10 license file detected Fuzzing ⚠️ 0 project is not fuzzed Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches Signed-Releases ⚠️ -1 no releases found SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
npm/figures	6.1.0	🟢 4.1	Details Check Score Reason Binary-Artifacts 🟢 10 no binaries found in the repo Code-Review 🟢 6 Found 19/30 approved changesets -- score normalized to 6 Security-Policy 🟢 10 security policy file detected Packaging ⚠️ -1 packaging workflow not detected Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Maintained ⚠️ 0 0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0 Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches Signed-Releases ⚠️ -1 no releases found SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
npm/find-up	8.0.0	🟢 3.7	Details Check Score Reason Maintained ⚠️ 0 0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0 Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Packaging ⚠️ -1 packaging workflow not detected Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 Security-Policy 🟢 10 security policy file detected Code-Review ⚠️ 2 Found 8/30 approved changesets -- score normalized to 2 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Binary-Artifacts 🟢 10 no binaries found in the repo CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
npm/get-stream	9.0.1	🟢 4.3	Details Check Score Reason Maintained ⚠️ 0 0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Security-Policy 🟢 10 security policy file detected Code-Review 🟢 8 Found 24/30 approved changesets -- score normalized to 8 Binary-Artifacts 🟢 10 no binaries found in the repo Packaging ⚠️ -1 packaging workflow not detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
npm/get-tsconfig	4.14.3	Unknown	Unknown
npm/human-signals	8.0.1	⚠️ 2.8	Details Check Score Reason Code-Review ⚠️ 0 Found 0/30 approved changesets -- score normalized to 0 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Maintained ⚠️ 0 0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0 Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Binary-Artifacts 🟢 10 no binaries found in the repo Packaging ⚠️ -1 packaging workflow not detected SAST ⚠️ 0 no SAST tool detected Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Security-Policy ⚠️ 0 security policy file not detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches
npm/is-stream	4.0.1	🟢 3.7	Details Check Score Reason Code-Review ⚠️ 2 Found 8/30 approved changesets -- score normalized to 2 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Maintained ⚠️ 0 0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0 Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Packaging ⚠️ -1 packaging workflow not detected Security-Policy 🟢 10 security policy file detected Binary-Artifacts 🟢 10 no binaries found in the repo CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches Signed-Releases ⚠️ -1 no releases found SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
npm/is-unicode-supported	2.1.0	🟢 3.7	Details Check Score Reason Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Maintained ⚠️ 0 0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0 Binary-Artifacts 🟢 10 no binaries found in the repo Packaging ⚠️ -1 packaging workflow not detected Code-Review ⚠️ 2 Found 4/20 approved changesets -- score normalized to 2 Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Security-Policy 🟢 10 security policy file detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
npm/leven	4.1.0	🟢 3.6	Details Check Score Reason Packaging ⚠️ -1 packaging workflow not detected Maintained ⚠️ 0 1 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Code-Review ⚠️ 2 Found 8/30 approved changesets -- score normalized to 2 Binary-Artifacts 🟢 10 no binaries found in the repo Security-Policy 🟢 9 security policy file detected Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
npm/locate-path	8.0.0	🟢 3.7	Details Check Score Reason Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Binary-Artifacts 🟢 10 no binaries found in the repo Packaging ⚠️ -1 packaging workflow not detected Maintained ⚠️ 0 0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0 Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Code-Review ⚠️ 2 Found 8/30 approved changesets -- score normalized to 2 Security-Policy 🟢 10 security policy file detected Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches Signed-Releases ⚠️ -1 no releases found SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
npm/npm-run-path	6.0.0	🟢 3.9	Details Check Score Reason Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Code-Review 🟢 4 Found 14/30 approved changesets -- score normalized to 4 Security-Policy 🟢 10 security policy file detected Maintained ⚠️ 0 0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0 Binary-Artifacts 🟢 10 no binaries found in the repo Packaging ⚠️ -1 packaging workflow not detected Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
npm/orval	8.27.0	Unknown	Unknown
npm/p-limit	4.0.0	🟢 3.7	Details Check Score Reason Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Maintained ⚠️ 1 2 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 1 Packaging ⚠️ -1 packaging workflow not detected Binary-Artifacts 🟢 10 no binaries found in the repo Security-Policy 🟢 10 security policy file detected Code-Review ⚠️ 1 Found 5/30 approved changesets -- score normalized to 1 Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
npm/p-locate	6.0.0	🟢 3.7	Details Check Score Reason Maintained ⚠️ 0 0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0 Binary-Artifacts 🟢 10 no binaries found in the repo Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Code-Review ⚠️ 2 Found 6/27 approved changesets -- score normalized to 2 Packaging ⚠️ -1 packaging workflow not detected Security-Policy 🟢 10 security policy file detected Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches Signed-Releases ⚠️ -1 no releases found SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
npm/parse-ms	4.0.0	🟢 3.7	Details Check Score Reason Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Security-Policy 🟢 10 security policy file detected Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 Code-Review ⚠️ 2 Found 8/27 approved changesets -- score normalized to 2 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Packaging ⚠️ -1 packaging workflow not detected Binary-Artifacts 🟢 10 no binaries found in the repo Maintained ⚠️ 0 0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
npm/path-key	4.0.0	🟢 3.8	Details Check Score Reason Packaging ⚠️ -1 packaging workflow not detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Security-Policy 🟢 10 security policy file detected Binary-Artifacts 🟢 10 no binaries found in the repo Code-Review 🟢 3 Found 7/23 approved changesets -- score normalized to 3 Maintained ⚠️ 0 0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0 Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
npm/pretty-ms	9.3.1	🟢 4	Details Check Score Reason Code-Review 🟢 4 Found 13/30 approved changesets -- score normalized to 4 Packaging ⚠️ -1 packaging workflow not detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Security-Policy 🟢 10 security policy file detected Binary-Artifacts 🟢 10 no binaries found in the repo Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 Maintained ⚠️ 1 1 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 1 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
npm/remeda	2.45.0	🟢 7.9	Details Check Score Reason Code-Review ⚠️ 0 Found 0/13 approved changesets -- score normalized to 0 Maintained 🟢 10 30 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10 Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Dependency-Update-Tool 🟢 10 update tool detected Security-Policy 🟢 10 security policy file detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Binary-Artifacts 🟢 10 no binaries found in the repo Pinned-Dependencies 🟢 9 dependency not pinned by hash detected -- score normalized to 9 CII-Best-Practices 🟢 5 badge detected: Passing Signed-Releases 🟢 8 5 out of the last 5 releases have a total of 5 signed artifacts. Vulnerabilities ⚠️ 0 12 existing vulnerabilities detected Packaging 🟢 10 packaging workflow detected Fuzzing 🟢 10 project is fuzzed SAST 🟢 10 SAST tool is run on all commits Branch-Protection 🟢 5 branch protection is not maximal on development and all release branches License 🟢 10 license file detected CI-Tests 🟢 10 30 out of 30 merged PRs checked by a CI test -- score normalized to 10 Contributors 🟢 10 project has 7 contributing companies or organizations
npm/resolve-pkg-maps	1.0.0	Unknown	Unknown
npm/strip-final-newline	4.0.0	🟢 3.8	Details Check Score Reason Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Code-Review 🟢 3 Found 7/20 approved changesets -- score normalized to 3 Packaging ⚠️ -1 packaging workflow not detected Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 Binary-Artifacts 🟢 10 no binaries found in the repo Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Maintained ⚠️ 0 0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0 Security-Policy 🟢 10 security policy file detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0 Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches
npm/yaml	2.9.0	🟢 8	Details Check Score Reason Code-Review 🟢 7 Found 3/4 approved changesets -- score normalized to 7 Security-Policy 🟢 10 security policy file detected Packaging ⚠️ -1 packaging workflow not detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Maintained 🟢 10 30 commit(s) and 5 issue activity found in the last 90 days -- score normalized to 10 Binary-Artifacts 🟢 10 no binaries found in the repo Token-Permissions 🟢 9 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Pinned-Dependencies ⚠️ 2 dependency not pinned by hash detected -- score normalized to 2 License 🟢 10 license file detected Fuzzing 🟢 10 project is fuzzed Signed-Releases ⚠️ -1 no releases found Branch-Protection 🟢 3 branch protection is not maximal on development and all release branches SAST 🟢 10 SAST tool is run on all commits
npm/yocto-queue	1.2.2	🟢 3.6	Details Check Score Reason Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 Binary-Artifacts 🟢 10 no binaries found in the repo Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Packaging ⚠️ -1 packaging workflow not detected Maintained ⚠️ 0 0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0 Code-Review ⚠️ 1 Found 3/17 approved changesets -- score normalized to 1 Security-Policy 🟢 10 security policy file detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
npm/yoctocolors	2.2.0	Unknown	Unknown

Scanned Files

• frontend/package.json
• pnpm-lock.yaml