CVE-2026-23947
published 2026-01-20CVE-2026-23947: Orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification. Versions prior to 7.19.0 until 8.0.2 are vulnerable to…
PriorityP261critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.84%
56.0th percentile
Orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification. Versions prior to 7.19.0 until 8.0.2 are vulnerable to arbitrary code execution in environments consuming generated clients. This issue is similar in nature to CVE-2026-22785, but affects a different code path in @orval/core that was not addressed by CVE-2026-22785's fix. The vulnerability allows untrusted OpenAPI specifications to inject arbitrary TypeScript/JavaScript code into generated clients via the x-enumDescriptions field, which is embedded without proper escaping in getEnumImplementation(). I have confirmed that the injection occurs during const enum generation and results in executable code within the generated schema files. Orval 7.19.0 and 8.0.2 contain a fix for the issue.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| orval-labs | orval | — | — |
| orval-labs | orval | — | — |
| orval-labs | orval | >= 0 < 8.21.0 | 8.21.0 |
| orval | core | >= 0 < 7.19.0 | 7.19.0 |
| orval | core | >= 7.19.0 < 7.21.0 | 7.21.0 |
| orval | core | >= 8.0.0 < 8.2.0 | 8.2.0 |
| orval | core | >= 8.0.0-rc.0 < 8.0.2 | 8.0.2 |
| orval | orval | < 7.19.0 | 7.19.0 |
| orval | orval | >= 7.19.0 < 7.21.0 | 7.21.0 |
| orval | orval | >= 8.0.0 < 8.0.2 | 8.0.2 |
| orval | orval | >= 8.0.0 < 8.2.0 | 8.2.0 |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv4.09.3CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
ghsa9.8CRITICAL
osv9.3CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Orval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout)
ghsa·2026-09-03·CVSS 9.8
CVE-2026-62681 [CRITICAL] CWE-94 Orval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout)
Orval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout)
### Summary
Orval emits the OpenAPI path into the generated request URL as a TEMPLATE LITERAL (`` `/users/...` ``) without escaping the backtick character. A path containing a backtick closes the template literal and injects a concatenation expression that is evaluated when the generated URL/request/key function is called, executing attacker-controlled code. Affects the axios, fetch, react-query, and swr clients. Verified on Orval 8.19.0; survives Orval's default OpenAPI validation.
### Details
```ts
// generated URL builder (fetch client)
return `/users/` + (globalThis.X = require("fs").writeFileSync("/marker","pwned")) + `/list`;
```
The backtick in the path terminates the `` `...` `` literal;
GHSA
Orval: RCE via servers[].url -> unescaped request-URL template literal (with getBaseUrlFromSpecification)
ghsa·2026-09-03·CVSS 9.8
CVE-2026-62682 [CRITICAL] CWE-94 Orval: RCE via servers[].url -> unescaped request-URL template literal (with getBaseUrlFromSpecification)
Orval: RCE via servers[].url -> unescaped request-URL template literal (with getBaseUrlFromSpecification)
### Summary
When Orval is configured with `output.baseUrl.getBaseUrlFromSpecification: true`, it bakes the spec's `servers[0].url` into the generated request URL as a template literal without escaping the backtick. A server URL containing a backtick closes the template literal and injects a concatenation expression evaluated when the generated URL/request function is called, executing attacker-controlled code. Verified on Orval 8.19.0 (fetch client); survives default OpenAPI validation.
### Details
```ts
return `http://api.x/` + (globalThis.X = require("fs").writeFileSync("/marker","pwned")) + `/v1/u`;
```
Prerequisite: the documented `getBaseUrlFromSpecification: true` option (ta
GHSA
Orval: Generation-time SSRF + remote/local file inclusion via unrestricted $ref
ghsa·2026-09-02·CVSS 9.8
CVE-2026-62680 [CRITICAL] CWE-22 Orval: Generation-time SSRF + remote/local file inclusion via unrestricted $ref
Orval: Generation-time SSRF + remote/local file inclusion via unrestricted $ref
### Summary
Orval resolves OpenAPI `$ref`s by fetching remote `http(s)` URLs and reading local files (including
absolute / out-of-tree paths), inlining the referenced schema into the generated client. Running
`orval` on a spec whose `$ref` points at an attacker/internal URL or an arbitrary local file yields
SSRF, remote file inclusion, and local file inclusion. Verified on 8.19.0. This is a different class
from Orval's published output-injection CVEs (CVE-2026-22785/23947/24132/25141), none of which covers
the `$ref` resolver.
### Details
- `$ref: http://attacker/internal-evil.json#/...` → build host fetches (SSRF) and inlines the remote
schema (RFI); confirmed property `REMOTE_ORVAL_PROP` in the generated
GHSA
Orval has Code Injection via unsanitized x-enum-descriptions using JS comments
ghsa·2026-01-30·CVSS 9.3
CVE-2026-25141 [CRITICAL] CWE-84 Orval has Code Injection via unsanitized x-enum-descriptions using JS comments
Orval has Code Injection via unsanitized x-enum-descriptions using JS comments
[CVE-2026-23947](https://github.com/advisories/GHSA-h526-wf6g-67jv) had an incomplete fix
While the current [jsStringEscape](https://github.com/orval-labs/orval/blob/02211fc413524be340ba9ace866a2ef68845ca7c/packages/core/src/utils/string.ts#L227) function properly handles single quotes ('), double quotes (") and other characters, it fails to sanitize * and / characters. This allows attackers to break out of JavaScript comment blocks using */ sequences and inject arbitrary code into generated files.
**Example:**
```yaml
openapi: 3.0.4
info:
title: Enum PoC
version: "1.0.0"
paths:
/ping:
get:
operationId: ping
responses:
"200":
description: ok
content:
application/json:
schema:
$ref: "#/components/schemas/Evi
OSV
Orval has Code Injection via unsanitized x-enum-descriptions using JS comments
osv·2026-01-30·CVSS 9.3
CVE-2026-25141 [CRITICAL] Orval has Code Injection via unsanitized x-enum-descriptions using JS comments
Orval has Code Injection via unsanitized x-enum-descriptions using JS comments
[CVE-2026-23947](https://github.com/advisories/GHSA-h526-wf6g-67jv) had an incomplete fix
While the current [jsStringEscape](https://github.com/orval-labs/orval/blob/02211fc413524be340ba9ace866a2ef68845ca7c/packages/core/src/utils/string.ts#L227) function properly handles single quotes ('), double quotes (") and other characters, it fails to sanitize * and / characters. This allows attackers to break out of JavaScript comment blocks using */ sequences and inject arbitrary code into generated files.
**Example:**
```yaml
openapi: 3.0.4
info:
title: Enum PoC
version: "1.0.0"
paths:
/ping:
get:
operationId: ping
responses:
"200":
description: ok
content:
application/json:
schema:
$ref: "#/components/schemas/Evi
GHSA
Orval has a code injection via unsanitized x-enum-descriptions in enum generation
ghsa·2026-01-21·CVSS 9.3
CVE-2026-23947 [CRITICAL] CWE-77 Orval has a code injection via unsanitized x-enum-descriptions in enum generation
Orval has a code injection via unsanitized x-enum-descriptions in enum generation
### Impact
Arbitrary code execution in environments consuming generated clients
This issue is similar in nature to the recently-patched MCP vulnerability (CVE-2026-22785), but affects a different code path in @orval/core that was not addressed by that fix.
The vulnerability allows untrusted OpenAPI specifications to inject arbitrary TypeScript/JavaScript code into generated clients via the x-enumDescriptions field, which is embedded without proper escaping in getEnumImplementation(). I have confirmed that the injection occurs during const enum generation and results in executable code within the generated schema files.
### Patches
Upgrade to Orval 8.0.2
### References
An example OpenAPI showing the issue
OSV
Orval has a code injection via unsanitized x-enum-descriptions in enum generation
osv·2026-01-21·CVSS 9.3
CVE-2026-23947 [CRITICAL] Orval has a code injection via unsanitized x-enum-descriptions in enum generation
Orval has a code injection via unsanitized x-enum-descriptions in enum generation
### Impact
Arbitrary code execution in environments consuming generated clients
This issue is similar in nature to the recently-patched MCP vulnerability (CVE-2026-22785), but affects a different code path in @orval/core that was not addressed by that fix.
The vulnerability allows untrusted OpenAPI specifications to inject arbitrary TypeScript/JavaScript code into generated clients via the x-enumDescriptions field, which is embedded without proper escaping in getEnumImplementation(). I have confirmed that the injection occurs during const enum generation and results in executable code within the generated schema files.
### Patches
Upgrade to Orval 8.0.2
### References
An example OpenAPI showing the issue
No detection rules found.
No public exploits indexed.
Wiz
CVE-2026-25141 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 9.3
CVE-2026-25141 [CRITICAL] CVE-2026-25141 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-25141 :
JavaScript vulnerability analysis and mitigation
Orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification. Versions starting with 7.19.0 and prior to 7.21.0 and 8.2.0 have an incomplete fix for CVE-2026-23947. While the jsStringEscape function properly handles single quotes ('), double quotes (") and so on, it is still possible to achieve code injection using only a limited set of characters that are currently not escaped. The vulnerability lies in the fact that the application can be forced to execute arbitrary JavaScript using characters such as !+. By using a technique known as JSFuck, an attacker can bypass the current sanitization logic and run arbitrary code without needing any alphanumeric characters or quotes. Ver
Wiz
CVE-2026-23947 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 9.3
CVE-2026-23947 [CRITICAL] CVE-2026-23947 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-23947 :
JavaScript vulnerability analysis and mitigation
Orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification. Versions prior to 7.19.0 until 8.0.2 are vulnerable to arbitrary code execution in environments consuming generated clients. This issue is similar in nature to CVE-2026-22785, but affects a different code path in @orval/core that was not addressed by CVE-2026-22785's fix. The vulnerability allows untrusted OpenAPI specifications to inject arbitrary TypeScript/JavaScript code into generated clients via the x-enumDescriptions field, which is embedded without proper escaping in getEnumImplementation(). I have confirmed that the injection occurs during const enum generation and results in executable code within the gener
2026-01-20
Published