CVE-2026-25141
Critical · 9.8CVSS
9.8
EPSS
0.7%
Published
Jan 30, 2026
CISA due date
—
The record
Orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification. Versions starting with 7.19.0 and prior to 7.21.0 and 8.2.0 have an incomplete fix for CVE-2026-23947. While the jsStringEscape function properly handles single quotes ('), double quotes (") and so on, it is still possible to achieve code injection using only a limited set of characters that are currently not escaped. The vulnerability lies in the fact that the application can be forced to execute arbitrary JavaScript using characters such as []()!+. By using a technique known as JSFuck, an attacker can bypass the current sanitization logic and run arbitrary code without needing any alphanumeric characters or quotes. Version 7.21.0 and 8.2.0 contain an updated fix.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @orval/core | 0 | 7.19.0 |
| npm | @orval/core | 7.19.0 | 7.21.0 |
| npm | @orval/core | 8.0.0 | 8.2.0 |
| npm | @orval/core | 8.0.0-rc.0 | 8.0.2 |
Related vulnerabilities
- GHSA-gch2-phqh-fg9q Orval has Code Injection via unsanitized x-enum-descriptions using JS comments Same vulnerability
- GHSA-h526-wf6g-67jv Orval has a code injection via unsanitized x-enum-descriptions in enum generation Same vulnerability
- CVE-2026-23947 Orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2… Also affects @orval/core
- CVE-2026-114125 Storybook is a frontend workshop for building user interface components and pages in… CWE-94
- CVE-2026-113776 virtualenv is a tool for creating isolated virtual python environments. CWE-94
- CVE-2026-112100 A vulnerability was determined in DeepPavlov up to 1.7.0. CWE-94
- CVE-2026-112095 A flaw has been found in SourceCodester Inventory System 1.0. CWE-94
- CVE-2026-112042 A security flaw has been discovered in diem-project diem up to… CWE-94