CVE-2026-22785

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-22785", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-09T18:27:19.388Z", "datePublished": "2026-01-12T18:43:16.637Z", "dateUpdated": "2026-01-12T18:56:50.902Z"}, "containers": {"cna": {"title": "orval MCP client is vulnerable to a code injection attack.", "problemTypes": [{"descriptions": [{"cweId": "CWE-77", "lang": "en", "description": "CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 9.3, "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/orval-labs/orval/security/advisories/GHSA-mwr6-3gp8-9jmj", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/orval-labs/orval/security/advisories/GHSA-mwr6-3gp8-9jmj"}, {"name": "https://github.com/orval-labs/orval/commit/80b5fe73b94f120a3a5561952d6d4b0f8d7e928d", "tags": ["x_refsource_MISC"], "url": "https://github.com/orval-labs/orval/commit/80b5fe73b94f120a3a5561952d6d4b0f8d7e928d"}], "affected": [{"vendor": "orval-labs", "product": "orval", "versions": [{"version": "< 7.18.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-12T18:43:16.637Z"}, "descriptions": [{"lang": "en", "value": "orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification. Prior to 7.18.0, the MCP server generation logic relies on string manipulation that incorporates the summary field from the OpenAPI specification without proper validation or escaping. This allows an attacker to \"break out\" of the string literal and inject arbitrary code. This vulnerability is fixed in 7.18.0."}], "source": {"advisory": "GHSA-mwr6-3gp8-9jmj", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-12T18:56:42.000281Z", "id": "CVE-2026-22785", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-12T18:56:50.902Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-22785", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-01-12T18:56:42.000281Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-12T18:56:47.592Z"}}], "cna": {"title": "orval MCP client is vulnerable to a code injection attack.", "source": {"advisory": "GHSA-mwr6-3gp8-9jmj", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 9.3, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "orval-labs", "product": "orval", "versions": [{"status": "affected", "version": "< 7.18.0"}]}], "references": [{"url": "https://github.com/orval-labs/orval/security/advisories/GHSA-mwr6-3gp8-9jmj", "name": "https://github.com/orval-labs/orval/security/advisories/GHSA-mwr6-3gp8-9jmj", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/orval-labs/orval/commit/80b5fe73b94f120a3a5561952d6d4b0f8d7e928d", "name": "https://github.com/orval-labs/orval/commit/80b5fe73b94f120a3a5561952d6d4b0f8d7e928d", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification. Prior to 7.18.0, the MCP server generation logic relies on string manipulation that incorporates the summary field from the OpenAPI specification without proper validation or escaping. This allows an attacker to \"break out\" of the string literal and inject arbitrary code. This vulnerability is fixed in 7.18.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-77", "description": "CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-12T18:43:16.637Z"}}}, "cveMetadata": {"cveId": "CVE-2026-22785", "state": "PUBLISHED", "dateUpdated": "2026-01-12T18:56:50.902Z", "dateReserved": "2026-01-09T18:27:19.388Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-12T18:43:16.637Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "orval", "vendor": "orval-labs", "versions": [{"status": "affected", "version": "< 7.18.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:orval:orval:*:*:*:*:*:*:*:*", "matchCriteriaId": "0CE41D63-5D8F-40BA-A27D-11AD851BE739", "versionEndExcluding": "7.18.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification. Prior to 7.18.0, the MCP server generation logic relies on string manipulation that incorporates the summary field from the OpenAPI specification without proper validation or escaping. This allows an attacker to \"break out\" of the string literal and inject arbitrary code. This vulnerability is fixed in 7.18.0."}, {"lang": "es", "value": "orval genera clientes JS con seguridad de tipos (TypeScript) a partir de cualquier especificaci\u00f3n OpenAPI v3 o Swagger v2 v\u00e1lida. Antes de la versi\u00f3n 7.18.0, la l\u00f3gica de generaci\u00f3n del servidor MCP se basa en la manipulaci\u00f3n de cadenas que incorpora el campo 'summary' de la especificaci\u00f3n OpenAPI sin una validaci\u00f3n o escape adecuados. Esto permite a un atacante 'escapar' del literal de cadena e inyectar c\u00f3digo arbitrario. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 7.18.0."}], "id": "CVE-2026-22785", "lastModified": "2026-06-17T10:20:25.400", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-22785", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-01-12T18:56:42.000281Z", "version": "2.0.3"}}]}, "published": "2026-01-12T19:16:04.287", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/orval-labs/orval/commit/80b5fe73b94f120a3a5561952d6d4b0f8d7e928d"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/orval-labs/orval/security/advisories/GHSA-mwr6-3gp8-9jmj"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-77"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T16:27:54.716403+00:00", "value": {"mitigation_remediation": ["Apply the official patch by upgrading orval to version 7.18.0 or later.", "When upgrading is delayed, sanitize the summary field in any OpenAPI specification before feeding it to the MCP server \u2013 escape or strip characters that could break out of string literals.", "Restrict the use of the MCP server to trusted OpenAPI specifications only, or disable the feature for untrusted sources until a patch is applied."], "summary": {"action": "Immediate Patch", "impact": "Remote code execution via code injection in generated JavaScript clients"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the orval tool produced by orval-labs, specifically versions prior to 7.18.0. All releases before 7.18.0 that rely on the MCP server generation logic are susceptible.", "description_and_impact": "orval\u2019s MCP client allows an attacker to inject arbitrary code by exploiting a lack of proper validation or escaping when incorporating the summary field from an OpenAPI specification into string manipulation during client generation. The vulnerability can lead to the execution of unintended code in the generated JavaScript (TypeScript) client, compromising confidentiality, integrity, or availability of systems that consume the malicious client.", "risk_and_exploitability": "The issue has a CVSS score of 9.3, indicating high severity, and an EPSS score of less than 1%, suggesting exploitation is not common but still technically possible. It is not currently listed in the CISA KEV catalog. The attack vector is inferred to be the delivery of a crafted OpenAPI specification that contains a malicious summary field to the MCP server, thereby enabling injection of arbitrary JavaScript code."}}}}, "created": "2026-01-13T09:27:12.444889+00:00", "updated": "2026-04-18T16:30:05.090768+00:00", "vendors": ["orval-labs", "orval-labs$PRODUCT$orval"]}