Skip to content
OpenAdvisories

Vendor

orval-labs

22 known vulnerabilities.

Products

orval 22
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.3
    CVE-2026-23947 Public exploit

    Orval MCP client is vulnerable to code injection via unsanitized x-enum-descriptions in enum generation

    Orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification. Versions prior to 7.19.0 until 8.0.2 are vulnerable to arbitrary code execution in environments consuming generated clients. This issue is similar in natu…

    orval-labs orval @orval/core npm
  • Critical 9.3
    CVE-2026-22785 Public exploit

    orval MCP client is vulnerable to a code injection attack.

    orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification. Prior to 7.18.0, the MCP server generation logic relies on string manipulation that incorporates the summary field from the OpenAPI specification without …

    orval-labs orval @orval/mcp npm