Exploitation ongoing with high activity in latest observed window (1 mentions)
Recommended action window: Immediate (within 24h)
NVD description
orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification. Prior to 7.18.0, the MCP server generation logic relies on string manipulation that incorporates the summary field from the OpenAPI specification without proper validation or escaping. This allows an attacker to "break out" of the string literal and inject arbitrary code. This vulnerability is fixed in 7.18.0.
Priority
HIGH
Exploitation
ACTIVE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-04-05 | 2 | Active Exploitation1Disclosure1 |
| 2026-04-26 | 1 | General1 |
CVE-2026-22785: ضربة سيادية على Orval MCP 🛡️ كود Orval لم يعد ساحة للمهاجمين - تحت قبضة المحارب
Post summary
The post announces that CVE‑2026‑22785 on Orval MCP has been remediated, stating the code is no longer vulnerable, but provides no technical details, exploits, or specific patch information.
🧵 Twitter/LinkedIn Thread - CVE-2026-22785 Tweet 1/7 🔥 ``` ⚔️ ضربة سيادية: كود Orval MCP لم يعد ساحة للمهاجمين اكتشفنا CVE-2026-22785 - ثغرة Code Injection حرجة (CVSS 9.8) في @orval/mcp تسمح بـ RCE كامل! #CyberSecurity #Vulnerability #RCE 🧵 Thread ⬇️ ``` --- ## Tweet 2/7 🎯 ``` 🔬 التحليل: الثغرة في حقل "summary" بملفات OpenAPI - حقن مباشر دون تعقيم! Payload بسيط: summary: "'; execSync('rm -rf /');//" النتيجة: تنفيذ أوامر نظامية فوري 💀 #InfoSec #BugBounty ``` --- ## Tweet 3/7 💣 ``` 🎪 سيناريو الاستغلال: 1️⃣ مهاجم ينشئ OpenAPI spec خبيث 2️⃣ مطور يشغل `orval generate` 3️⃣ الكود المحقون يُنفذ تلقائياً 4️⃣ Backdoor نشط على السيرفر الوقت من الرفع للاختراق: <30 ثانية ⏱️ ``` --- ## Tweet 4/7 🛡️ ``` ✅ الحل الفوري: 1. التحديث لـ @orval/mcp >= 7.18.0 2. مراجعة كل ملفات OpenAPI 3. فحص السجلات للاختراقات 4. تغيير Credentials ⚡ لا تؤجل - الاستغلال في الـ wild! #PatchTuesday ``` --- ## Tweet 5/7 🔍 ``` 🕵️ علامات الاختراق: ❌ عمليات node مشبوهة ❌ اتصالات شبكية غير مبررة ❌ ملفات في /tmp/*.sh ❌ استهلاك CPU مرتفع أداة الفحص: [رابط GitHub] #ThreatHunting #DFIR ``` --- ## Tweet 6/7 🎓 ``` 📚 الدرس: "Input Validation is NOT optional" كل مدخل خارجي = تهديد محتمل حتى لو كان OpenAPI spec "موثوق" عقّم → تحقق → عقّم مرة أخرى #SecureCoding #DevSecOps ``` --- ## Tweet 7/7 🏆 ``` ⚔️ Zayed Security Research Team نحن لا نبحث عن الثغرات، نصطادها 🎯 CVE-2026-22785: من الكشف للإصلاح في 7 أيام للتواصل: [بريدك] #CyberWarrior #BugHunter #WhiteHat ``` --- ## LinkedIn Post (نسخة احترافية) 💼 ``` 🛡️ Critical Security Alert: CVE-2026-22785 in Orval MCP Dear Cybersecurity Community, I'm sharing details of a critical vulnerability (CVSS 9.8) we discovered in @orval/mcp - a popular OpenAPI to MCP server generator. 🔴 THE VULNERABILITY: Unsanitized "summary" field in OpenAPI specs allows direct JavaScript code injection, leading to Remote Code Execution. ⚡ IMPACT: - Full system compromise - Data exfiltration - Supply chain attack vector - Affects CI/CD pipelines ✅ IMMEDIATE ACTION REQUIRED: Update to @orval/mcp >= 7.18.0 🔬 TECHNICAL DETAILS: [Link to full report] ⏰ TIMELINE: Dec 1: Discovery Dec 8: Patch released Dec 10: Public disclosure 🏆 RESPONSIBLE DISCLOSURE: We followed coordinated disclosure practices, working closely with maintainers to ensure a timely patch. Stay vigilant. Stay secure. #CyberSecurity #VulnerabilityDisclosure #RCE #InfoSec ``` --- ## GitHub Issue Template 📝 ```markdown ## 🔴 SECURITY: Critical Code Injection in @orval/mcp **CVE ID:** CVE-2026-22785 **Severity:** Critical (CVSS 9.8) **Status:** ✅ PATCHED in v7.18.0 ### Description Code injection vulnerability in the OpenAPI summary field processing allows remote code execution. Affected Versions - All versions < 7.18.0 Proof of Concept ```yaml summary: "Exploit'; require('child_process').execSync('calc');//" ``` Impact - Remote Code Execution - System compromise - Data breach potential Fix Update to v7.18.0+ #Timeline - 2025-12-01: Discovered - 2025-12-08: Patched - **2025-12-10**: Public disclosure Credits Zayed Security Research Team #References - CVE: CVE-2026-22785 - Advisory: GHSA-mwr6-3gp8-9jmj Reddit Post (r/netsec) 🎮 ` [CVE-2026-22785] Critical RCE in Orval MCP - OpenAPI Code Injection TL;DR: Found a nasty code injection in @orval/mcp that lets you execute arbitrary code via poisoned OpenAPI specs. CVSS 9.8. Patched in v7.18.0. The Bug: The library takes the "summary" field from OpenAPI and directly embeds it into generated JavaScript without sanitization. Classic injection. Why It Matters: - Used in many CI/CD pipelines - Trust assumption on OpenAPI specs - Supply chain attack vector PoC: Check out the full technical writeup [link] Disclosure: Responsibly disclosed. Patch available. Update NOW. Stay curious, stay secure 🛡️
Post summary
CVE-2026-22785 is a critical code injection in Orval MCP that permits remote code execution, is actively exploited in the wild, and has a publicly disclosed PoC with an available patch forcefully urging updates.
⚔️ ضربة سيادية: كود Orval MCP لم يعد ساحة للمهاجمين - تحت قبضة المحارب CVE-2026-22785 | CVSS 9.8 | RCE
Post summary
The text announces the newly disclosed CVE-2026-22785, providing its CVSS score and classification as a remote code execution vulnerability, but offers no evidence of active exploitation, PoC, or patch.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | orval | orval | - | - | - |