CVE-2026-23947
published 2026-01-20CVE-2026-23947: Orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification. Versions prior to 7.19.0 until 8.0.2 are vulnerable to…
PriorityP261critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.75%
50.3th percentile
Orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification. Versions prior to 7.19.0 until 8.0.2 are vulnerable to arbitrary code execution in environments consuming generated clients. This issue is similar in nature to CVE-2026-22785, but affects a different code path in @orval/core that was not addressed by CVE-2026-22785's fix. The vulnerability allows untrusted OpenAPI specifications to inject arbitrary TypeScript/JavaScript code into generated clients via the x-enumDescriptions field, which is embedded without proper escaping in getEnumImplementation(). I have confirmed that the injection occurs during const enum generation and results in executable code within the generated schema files. Orval 7.19.0 and 8.0.2 contain a fix for the issue.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| orval-labs | orval | — | — |
| orval-labs | orval | — | — |
| orval | core | >= 0 < 7.19.0 | 7.19.0 |
| orval | core | >= 7.19.0 < 7.21.0 | 7.21.0 |
| orval | core | >= 8.0.0 < 8.2.0 | 8.2.0 |
| orval | core | >= 8.0.0-rc.0 < 8.0.2 | 8.0.2 |
| orval | orval | < 7.19.0 | 7.19.0 |
| orval | orval | >= 7.19.0 < 7.21.0 | 7.21.0 |
| orval | orval | >= 8.0.0 < 8.0.2 | 8.0.2 |
| orval | orval | >= 8.0.0 < 8.2.0 | 8.2.0 |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv4.09.3CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
ghsa9.3CRITICAL
osv9.3CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Orval has Code Injection via unsanitized x-enum-descriptions using JS comments
ghsa·2026-01-30·CVSS 9.3
CVE-2026-25141 [CRITICAL] CWE-84 Orval has Code Injection via unsanitized x-enum-descriptions using JS comments
Orval has Code Injection via unsanitized x-enum-descriptions using JS comments
[CVE-2026-23947](https://github.com/advisories/GHSA-h526-wf6g-67jv) had an incomplete fix
While the current [jsStringEscape](https://github.com/orval-labs/orval/blob/02211fc413524be340ba9ace866a2ef68845ca7c/packages/core/src/utils/string.ts#L227) function properly handles single quotes ('), double quotes (") and other characters, it fails to sanitize * and / characters. This allows attackers to break out of JavaScript comment blocks using */ sequences and inject arbitrary code into generated files.
**Example:**
```yaml
openapi: 3.0.4
info:
title: Enum PoC
version: "1.0.0"
paths:
/ping:
get:
operationId: ping
responses:
"200":
description: ok
content:
application/json:
schema:
$ref: "#/components/schemas/Evi
OSV
Orval has Code Injection via unsanitized x-enum-descriptions using JS comments
osv·2026-01-30·CVSS 9.3
CVE-2026-25141 [CRITICAL] Orval has Code Injection via unsanitized x-enum-descriptions using JS comments
Orval has Code Injection via unsanitized x-enum-descriptions using JS comments
[CVE-2026-23947](https://github.com/advisories/GHSA-h526-wf6g-67jv) had an incomplete fix
While the current [jsStringEscape](https://github.com/orval-labs/orval/blob/02211fc413524be340ba9ace866a2ef68845ca7c/packages/core/src/utils/string.ts#L227) function properly handles single quotes ('), double quotes (") and other characters, it fails to sanitize * and / characters. This allows attackers to break out of JavaScript comment blocks using */ sequences and inject arbitrary code into generated files.
**Example:**
```yaml
openapi: 3.0.4
info:
title: Enum PoC
version: "1.0.0"
paths:
/ping:
get:
operationId: ping
responses:
"200":
description: ok
content:
application/json:
schema:
$ref: "#/components/schemas/Evi
GHSA
Orval has a code injection via unsanitized x-enum-descriptions in enum generation
ghsa·2026-01-21·CVSS 9.3
CVE-2026-23947 [CRITICAL] CWE-77 Orval has a code injection via unsanitized x-enum-descriptions in enum generation
Orval has a code injection via unsanitized x-enum-descriptions in enum generation
### Impact
Arbitrary code execution in environments consuming generated clients
This issue is similar in nature to the recently-patched MCP vulnerability (CVE-2026-22785), but affects a different code path in @orval/core that was not addressed by that fix.
The vulnerability allows untrusted OpenAPI specifications to inject arbitrary TypeScript/JavaScript code into generated clients via the x-enumDescriptions field, which is embedded without proper escaping in getEnumImplementation(). I have confirmed that the injection occurs during const enum generation and results in executable code within the generated schema files.
### Patches
Upgrade to Orval 8.0.2
### References
An example OpenAPI showing the issue
OSV
Orval has a code injection via unsanitized x-enum-descriptions in enum generation
osv·2026-01-21·CVSS 9.3
CVE-2026-23947 [CRITICAL] Orval has a code injection via unsanitized x-enum-descriptions in enum generation
Orval has a code injection via unsanitized x-enum-descriptions in enum generation
### Impact
Arbitrary code execution in environments consuming generated clients
This issue is similar in nature to the recently-patched MCP vulnerability (CVE-2026-22785), but affects a different code path in @orval/core that was not addressed by that fix.
The vulnerability allows untrusted OpenAPI specifications to inject arbitrary TypeScript/JavaScript code into generated clients via the x-enumDescriptions field, which is embedded without proper escaping in getEnumImplementation(). I have confirmed that the injection occurs during const enum generation and results in executable code within the generated schema files.
### Patches
Upgrade to Orval 8.0.2
### References
An example OpenAPI showing the issue
No detection rules found.
No public exploits indexed.
Wiz
CVE-2026-25141 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 9.3
CVE-2026-25141 [CRITICAL] CVE-2026-25141 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-25141 :
JavaScript vulnerability analysis and mitigation
Orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification. Versions starting with 7.19.0 and prior to 7.21.0 and 8.2.0 have an incomplete fix for CVE-2026-23947. While the jsStringEscape function properly handles single quotes ('), double quotes (") and so on, it is still possible to achieve code injection using only a limited set of characters that are currently not escaped. The vulnerability lies in the fact that the application can be forced to execute arbitrary JavaScript using characters such as !+. By using a technique known as JSFuck, an attacker can bypass the current sanitization logic and run arbitrary code without needing any alphanumeric characters or quotes. Ver
Wiz
CVE-2026-23947 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 9.3
CVE-2026-23947 [CRITICAL] CVE-2026-23947 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-23947 :
JavaScript vulnerability analysis and mitigation
Orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification. Versions prior to 7.19.0 until 8.0.2 are vulnerable to arbitrary code execution in environments consuming generated clients. This issue is similar in nature to CVE-2026-22785, but affects a different code path in @orval/core that was not addressed by CVE-2026-22785's fix. The vulnerability allows untrusted OpenAPI specifications to inject arbitrary TypeScript/JavaScript code into generated clients via the x-enumDescriptions field, which is embedded without proper escaping in getEnumImplementation(). I have confirmed that the injection occurs during const enum generation and results in executable code within the gener
2026-01-20
Published