Orval has Code Injection via unsanitized x-enum-descriptions using JS comments
- Severity:
- High
Description
CVE-2026-23947 had an incomplete fix
While the current jsStringEscape function properly handles single quotes (‘), double quotes (“) and other characters, it fails to sanitize * and / characters. This allows attackers to break out of JavaScript comment blocks using */ sequences and inject arbitrary code into generated files.
Example:
Recommendation
Update the @orval/core package to the latest compatible version. Followings are version details:
Affected version(s): **>= 8.0.0, < 8.2.0 >= 7.19.0, < 7.21.0** Patched version(s): **8.2.0 7.21.0**
References
Related Issues
- Orval has a code injection via unsanitized x-enum-descriptions in enum generation - CVE-2026-23947
- OpenZeppelin Contracts Wizard has Code Injection in Generated Hardhat and Foundry Tests via Unsanitized opts.name / opts - CVE-2026-48054
- SQL Injection via unsanitized JSON path keys when ignoring/silencing compilation errors or using `Kysely<any>`. - CVE-2026-32763
- Orval Mock Generation Code Injection via const - CVE-2026-24132
You might also like:
- Tags:
- npm
- @orval/core
Anything's wrong? Let us know Last updated on January 31, 2026