Description
CVE-2026-23947 had an incomplete fix
While the current jsStringEscape function properly handles single quotes (‘), double quotes (“) and other characters, it fails to sanitize * and / characters. This allows attackers to break out of JavaScript comment blocks using */ sequences and inject arbitrary code into generated files.
Example:
Recommendation
Update the @orval/core package to the latest compatible version. Followings are version details:
Affected version(s): **>= 8.0.0, < 8.2.0 >= 7.19.0, < 7.21.0** Patched version(s): **8.2.0 7.21.0**
References
Could your website be exposed too?
SmartScanner can check your website for Orval has Code Injection via unsanitized x-enum-descriptions using JS comments and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Orval has a code injection via unsanitized x-enum-descriptions in enum generation - CVE-2026-23947
- OpenZeppelin Contracts Wizard has Code Injection in Generated Hardhat and Foundry Tests via Unsanitized opts.name / opts - CVE-2026-48054
- SQL Injection via unsanitized JSON path keys when ignoring/silencing compilation errors or using `Kysely<any>`. - CVE-2026-32763
- Orval Mock Generation Code Injection via const - CVE-2026-24132
You might also like:
See something that needs correcting? Let us knowUpdated January 31, 2026