Orval has a code injection via unsanitized x-enum-descriptions in enum generation

Description

Arbitrary code execution in environments consuming generated clients

This issue is similar in nature to the recently-patched MCP vulnerability (CVE-2026-22785), but affects a different code path in @orval/core that was not addressed by that fix.

Recommendation

Update the @orval/core package to the latest compatible version. Followings are version details:

• Affected version(s): **< 7.19.0

  >= 8.0.0-rc.0, < 8.0.2**

• Patched version(s): **7.19.0

  8.0.2**

References

• GHSA-h526-wf6g-67jv
• CVE-2026-23947
• CWE-77
• CWE-94
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Orval has Code Injection via unsanitized x-enum-descriptions using JS comments - CVE-2026-25141
• OpenZeppelin Contracts Wizard has Code Injection in Generated Hardhat and Foundry Tests via Unsanitized opts.name / opts - CVE-2026-48054
• Orval Mock Generation Code Injection via const - CVE-2026-24132
• jsPDF has a PDF Object Injection via Unsanitized Input in addJS Method - CVE-2026-25755

You might also like:

How do hackers hack websites?

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

@orval/core