CVE-2026-96755 is a code injection vulnerability affecting orval versions 8.14.0 through 8.28.1. The flaw exists in the @orval/effect generator component that converts OpenAPI schema defaults into template literals. If an attacker supplies schema defaults containing JavaScript expressions within ${...} syntax, these expressions are executed at module scope when the generated code is built or imported, enabling arbitrary code execution.

Successful exploitation allows an attacker to execute arbitrary JavaScript code at module scope during code generation or import, potentially leading to full compromise of the build environment or runtime context. The CVSS 4.0 score of 9.3 reflects critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using untrusted OpenAPI schema defaults that may contain malicious ${...} expressions in orval versions 8.14.0 through 8.28.1. Monitor vendor channels for updates and apply patches promptly once released.