CVE-2026-96756 is a code injection vulnerability affecting orval versions prior to 8.30.0. The vulnerability exists in the @orval/core factory generator component, which fails to properly escape date default values when using new Date() calls. Attackers can exploit this by injecting malicious expressions through apostrophes in OpenAPI schema default values. Successful exploitation requires that the factoryMethods and useDates options are enabled, resulting in arbitrary code execution with the privileges of the process consuming the orval library.

An attacker can execute arbitrary code within the context of the consumer process using orval, potentially leading to full compromise of the affected system or application. The vulnerability has a CVSS 4.0 score of 9.2, indicating critical severity with network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability.

A fixed version 8.30.0 of orval is available that addresses this code injection vulnerability. Users should upgrade to version 8.30.0 or later to remediate this issue. No other mitigations are indicated.