Skip to content
OpenAdvisories

Package · npm

@orval/core

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Critical 9.3
    CVE-2026-23947 Public exploit

    Orval MCP client is vulnerable to code injection via unsanitized x-enum-descriptions in enum generation

    Orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification. Versions prior to 7.19.0 until 8.0.2 are vulnerable to arbitrary code execution in environments consuming generated clients. This issue is similar in natu…

    orval-labs orval @orval/core npm