CVE-2026-23947: Code Injection Vulnerability in @orval/core via Unsanitized x-enum-descriptions
Summary
CVE-2026-23947: Orval has a code injection via unsanitized x-enum-descriptions in enum generation. Affects @orval/core versions < 8.0.2. Fixed in 8.0.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @orval/core package is a tool designed for generating TypeScript and JavaScript clients from OpenAPI specifications. It simplifies the process of client generation, allowing developers to easily consume APIs. However, it has a critical vulnerability that arises from improper handling of user-defined inputs in OpenAPI specifications, specifically in the x-enumDescriptions field.
Vulnerability Detail
The vulnerability allows untrusted OpenAPI specifications to inject arbitrary TypeScript/JavaScript code into generated clients. This occurs through the x-enumDescriptions field, which is embedded without proper escaping in the getEnumImplementation() function. As a result, when the generated clients are executed, they can execute malicious code, leading to arbitrary code execution in environments consuming these clients. This issue is similar to the recently patched MCP vulnerability (CVE-2026-22785) but affects a different code path in the @orval/core package.
How To Fix
Minimum fixed version
8.0.2
This is the first release that contains the fix.
npm install @orval/core@8.0.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to upgrade to the patched version as soon as possible.
Conclusion
In summary, CVE-2026-23947 is a critical code injection vulnerability in the @orval/core package that allows for arbitrary code execution through unsanitized x-enumDescriptions in OpenAPI specifications. Users are strongly advised to upgrade to version 8.0.2 to mitigate this risk.
See every vulnerability recorded for @orval/core →
FAQ
The vulnerability allows for arbitrary code execution through unsanitized inputs in the x-enumDescriptions field of OpenAPI specifications.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which analyzes your package-lock.json for vulnerabilities.
If exploited, this vulnerability can lead to the execution of malicious code in environments that consume the generated clients, potentially compromising system integrity.
Yes, upgrading to version 8.0.2 of @orval/core addresses this vulnerability.
The CVSS score for this vulnerability is 9.3, indicating a critical severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for @orval/core.
