CVE-2026-96754

Summary

The flaw allows code injection by failing to escape OpenAPI path values, enabling arbitrary JavaScript code execution.

Exploitability

Exploitation is relatively straightforward with preconditions of an attacker-controlled OpenAPI document containing specific path segments.

Blast radius

If exploited, this could lead to full system compromise, as arbitrary code execution can be achieved.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to orval version 8.29.0 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.