GHSA-gch2-phqh-fg9q
NoneCVSS
—
EPSS
—
Published
Jan 30, 2026
CISA due date
—
The record
Orval has Code Injection via unsanitized x-enum-descriptions using JS comments
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @orval/core | 7.19.0 | 7.21.0 |
| npm | @orval/core | 8.0.0 | 8.2.0 |
Related vulnerabilities
- CVE-2026-25141 Orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2… Same vulnerability
- GHSA-h526-wf6g-67jv Orval has a code injection via unsanitized x-enum-descriptions in enum generation Also affects @orval/core
- CVE-2026-23947 Orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2… Also affects @orval/core
- CVE-2026-88859 A flaw was found in Evolution. CWE-84
- CVE-2026-114125 Storybook is a frontend workshop for building user interface components and pages in… CWE-94
- CVE-2026-113776 virtualenv is a tool for creating isolated virtual python environments. CWE-94
- CVE-2026-112100 A vulnerability was determined in DeepPavlov up to 1.7.0. CWE-94
- CVE-2026-112095 A flaw has been found in SourceCodester Inventory System 1.0. CWE-94