CVE-2026-96758 [CRITICAL] – orval @orval/core before 8.28.0 contains a code injection vulnerability in the form-data s

orval @orval/core before 8.28.0 contains a code injection vulnerability in the form-data serializer that fails to escape multipart property names in generated template literals. Attackers can inject ${…} expressions into OpenAPI schema property names that execute as live interpolation when the generated client builds FormData bodies with consumer process privileges.