Skip to content
OpenAdvisories

Package · npm

@orval/core

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Critical 9.3
    CVE-2026-25141

    Orval has a code injection via unsanitized x-enum-descriptions uing JS comments

    Orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification. Versions starting with 7.19.0 and prior to 7.21.0 and 8.2.0 have an incomplete fix for CVE-2026-23947. While the jsStringEscape function properly handles …

    orval-labs orval @orval/core npm
  • Critical 9.3
    CVE-2026-23947 Public exploit

    Orval MCP client is vulnerable to code injection via unsanitized x-enum-descriptions in enum generation

    Orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification. Versions prior to 7.19.0 until 8.0.2 are vulnerable to arbitrary code execution in environments consuming generated clients. This issue is similar in natu…

    orval-labs orval @orval/core npm