CVE Intelligence
Analysis AI-assisted

CVE-2026-22785: orval MCP generation code injection via OpenAPI summary field

orval, a generator of TypeScript/JavaScript clients from OpenAPI and Swagger specifications, builds MCP server code by inserting the specification's summary field without validation or escaping. According to the record, this lets a crafted specification break out of a string literal and inject arbitrary code, and NVD rates it critical with a CVSS 3.1 base score of 9.8. The record states the issue is fixed in 7.18.0, and no confirmed exploitation appears in the sources consulted.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

The CVE record describes orval, a tool that generates type-safe TypeScript/JavaScript clients from OpenAPI and Swagger specifications. The MCP server generation logic builds code through string manipulation and incorporates the summary field from the specification without proper validation or escaping. The weakness is classified as CWE-77 (Command Injection) in the record. Sources: GitHub advisory GHSA-mwr6-3gp8-9jmj and NVD entry.

Impact

  • The record states that an attacker can break out of the string literal and inject arbitrary code.
  • NVD assigns a CVSS 3.1 base score of 9.8 (critical) with network attack vector, low complexity, no privileges and no user interaction required.
  • Inference: the practical impact depends on where generated code is built or executed, so development machines and build pipelines that process untrusted specifications are the most relevant places to review.

Affected products and versions

  • Records list two product entries: Orval Orval and Orval-labs Orval, both affected before 7.18.0.
  • The fixed version given in the record is 7.18.0.
  • Versions at or after 7.18.0 are not listed as affected in the record.

Exploitation status

The CISA KEV catalog does not list this CVE, and the record shows no confirmed active exploitation. The EPSS probability is 0.00778 (percentile 0.55403). No confirmed exploitation appears in the sources consulted.

Remediation and mitigation

  • Upgrade orval to 7.18.0 or a later release, as indicated by the record and the fix commit.
  • After upgrading, regenerate clients and MCP server code and review the output.
  • Until the upgrade is complete, generate code only from specifications from trusted sources and review changes to specification summary fields.

Detection guidance

  • Compare generated files against the previous generation and look for unexpected code in string contexts derived from specification summaries.
  • Check dependency manifests and lockfiles in repositories and build images for orval versions before 7.18.0.
  • Review CI logs for generation steps that pull specifications from external or untrusted sources.

Limitations of the available information

  • The record does not describe the exact conditions required to trigger the flaw or the full set of affected generator outputs.
  • The record does not state whether any public proof of concept exists; a reference is tagged Exploit but no exploitation is confirmed.
  • Unknown: whether generated MCP code is deployed in production in typical usage and how exposed those deployments are.
  • Scores differ by source: NVD gives 9.8 (CVSS 3.1), while GitHub gives 9.3 (CVSS 4.0).

Frequently asked questions

Is this CVE confirmed to be actively exploited?

No. The CVE is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.

Which version fixes the issue?

The record states that the issue is fixed in 7.18.0. Upgrading to 7.18.0 or a later release is the recommended action.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.