Description
Arbitrary code execution in environments consuming generated clients
This issue is similar in nature to the recently-patched MCP vulnerability (CVE-2026-22785), but affects a different code path in @orval/core that was not addressed by that fix.
Recommendation
Update the @orval/core package to the latest compatible version. Followings are version details:
Affected version(s): **< 7.19.0 >= 8.0.0-rc.0, < 8.0.2** Patched version(s): **7.19.0 8.0.2**
References
Could your website be exposed too?
SmartScanner can check your website for Orval has a code injection via unsanitized x-enum-descriptions in enum generation and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Orval has Code Injection via unsanitized x-enum-descriptions using JS comments - CVE-2026-25141
- OpenZeppelin Contracts Wizard has Code Injection in Generated Hardhat and Foundry Tests via Unsanitized opts.name / opts - CVE-2026-48054
- Orval Mock Generation Code Injection via const - CVE-2026-24132
- jsPDF has a PDF Object Injection via Unsanitized Input in addJS Method - CVE-2026-25755
You might also like:
See something that needs correcting? Let us knowUpdated February 27, 2026