CVE-2026-25141
published 2026-01-30CVE-2026-25141: Orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification. Versions starting with 7.19.0 and prior to 7.21.0 and…
PriorityP260critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.60%
44.4th percentile
Orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification. Versions starting with 7.19.0 and prior to 7.21.0 and 8.2.0 have an incomplete fix for CVE-2026-23947. While the jsStringEscape function properly handles single quotes ('), double quotes (") and so on, it is still possible to achieve code injection using only a limited set of characters that are currently not escaped. The vulnerability lies in the fact that the application can be forced to execute arbitrary JavaScript using characters such as []()!+. By using a technique known as JSFuck, an attacker can bypass the current sanitization logic and run arbitrary code without needing any alphanumeric characters or quotes. Version 7.21.0 and 8.2.0 contain an updated fix.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| orval | core | >= 7.19.0 < 7.21.0 | 7.21.0 |
| orval | core | >= 8.0.0 < 8.2.0 | 8.2.0 |
| orval | orval | >= 7.19.0 < 7.21.0 | 7.21.0 |
| orval | orval | >= 8.0.0 < 8.2.0 | 8.2.0 |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv4.09.3CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
ghsa9.3CRITICAL
osv9.3CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Orval has Code Injection via unsanitized x-enum-descriptions using JS comments
ghsa·2026-01-30·CVSS 9.3
CVE-2026-25141 [CRITICAL] CWE-84 Orval has Code Injection via unsanitized x-enum-descriptions using JS comments
Orval has Code Injection via unsanitized x-enum-descriptions using JS comments
[CVE-2026-23947](https://github.com/advisories/GHSA-h526-wf6g-67jv) had an incomplete fix
While the current [jsStringEscape](https://github.com/orval-labs/orval/blob/02211fc413524be340ba9ace866a2ef68845ca7c/packages/core/src/utils/string.ts#L227) function properly handles single quotes ('), double quotes (") and other characters, it fails to sanitize * and / characters. This allows attackers to break out of JavaScript comment blocks using */ sequences and inject arbitrary code into generated files.
**Example:**
```yaml
openapi: 3.0.4
info:
title: Enum PoC
version: "1.0.0"
paths:
/ping:
get:
operationId: ping
responses:
"200":
description: ok
content:
application/json:
schema:
$ref: "#/components/schemas/Evi
OSV
Orval has Code Injection via unsanitized x-enum-descriptions using JS comments
osv·2026-01-30·CVSS 9.3
CVE-2026-25141 [CRITICAL] Orval has Code Injection via unsanitized x-enum-descriptions using JS comments
Orval has Code Injection via unsanitized x-enum-descriptions using JS comments
[CVE-2026-23947](https://github.com/advisories/GHSA-h526-wf6g-67jv) had an incomplete fix
While the current [jsStringEscape](https://github.com/orval-labs/orval/blob/02211fc413524be340ba9ace866a2ef68845ca7c/packages/core/src/utils/string.ts#L227) function properly handles single quotes ('), double quotes (") and other characters, it fails to sanitize * and / characters. This allows attackers to break out of JavaScript comment blocks using */ sequences and inject arbitrary code into generated files.
**Example:**
```yaml
openapi: 3.0.4
info:
title: Enum PoC
version: "1.0.0"
paths:
/ping:
get:
operationId: ping
responses:
"200":
description: ok
content:
application/json:
schema:
$ref: "#/components/schemas/Evi
No detection rules found.
No public exploits indexed.
https://github.com/orval-labs/orval/blob/02211fc413524be340ba9ace866a2ef68845ca7c/packages/core/src/utils/string.ts#L227https://github.com/orval-labs/orval/releases/tag/v7.21.0https://github.com/orval-labs/orval/releases/tag/v8.2.0https://github.com/orval-labs/orval/security/advisories/GHSA-gch2-phqh-fg9qhttps://github.com/orval-labs/orval/security/advisories/GHSA-h526-wf6g-67jv
2026-01-30
Published