orval vulnerabilities

Products

• orval 4
• @orval/core 2
• @orval/mcp 1
• @orval/mock 1

Latest orval CVEs

Newest publication first

1. CVE-2026-25141 Orval has a code injection via unsanitized x-enum-descriptions uing JS comments

   Published 2026-01-30

   Critical·CVSS 9.3 EPSS 0.69%

   Orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification. Versions starting with 7.19.0 and prior to 7.21.0 and 8.2.0 have an incomplete fix for CVE-2026-23947. While the jsStringEscape function properly handles single quotes ('), do...

2. CVE-2026-24132 Orval Mock Generation Code Injection via const

   Published 2026-01-22

   High·CVSS 7.7 EPSS 0.74%

   Orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification. Versions 7.19.0 and below and 8.0.0-rc.0 through 8.0.2 allow untrusted OpenAPI specifications to inject arbitrary TypeScript/JavaScript into generated mock files via the const...

3. CVE-2026-23947 Orval MCP client is vulnerable to code injection via unsanitized x-enum-descriptions in enum generation

   Published 2026-01-20

   Critical·CVSS 9.3 EPSS 0.84%

   Orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification. Versions prior to 7.19.0 until 8.0.2 are vulnerable to arbitrary code execution in environments consuming generated clients. This issue is similar in nature to CVE-2026-22785,...

4. CVE-2026-22785 orval MCP client is vulnerable to a code injection attack.

   Published 2026-01-12

   Critical·CVSS 9.3 EPSS 0.78%

   orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification. Prior to 7.18.0, the MCP server generation logic relies on string manipulation that incorporates the summary field from the OpenAPI specification without proper validation or...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.