CVE-2026-96758

Summary

The flaw allows code injection in the form-data serializer, enabling attackers to inject malicious ${...} expressions that can be executed during the generation of FormData bodies.

Exploitability

Exploitation is relatively straightforward given the preconditions of consumer process privileges. Attackers must have access to the affected version of the software.

Blast radius

If exploited, this vulnerability could lead to remote code execution and full control over the affected system or application.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to orval @orval/core 8.28.0 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.