Critical Code Injection Vulnerability in @orval/core Package
Summary
GHSA-gch2-phqh-fg9q: Orval has Code Injection via unsanitized x-enum-descriptions using JS comments. Affects @orval/core across 2 version ranges.
>= 7.19.0, < 7.21.0
>= 8.0.0, < 8.2.0
Fixed in 7.21.0 or 8.2.0, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @orval/core package is a tool designed for generating TypeScript clients from OpenAPI specifications. It streamlines the process of API integration by automating client code generation, thus enhancing developer productivity. However, a critical vulnerability has been identified that exposes users to potential code injection attacks, compromising the security of applications utilizing this package.
Vulnerability Detail
The vulnerability arises from the inadequate sanitization of user inputs in the x-enum-descriptions field within OpenAPI specifications. Specifically, the jsStringEscape function fails to properly handle certain characters, such as '*' and '/', allowing attackers to inject arbitrary JavaScript code. This can lead to severe consequences, including unauthorized access to system resources and execution of malicious commands. The vulnerability has been assigned a CVSS score of 9.3, indicating its critical nature.
How To Fix
Latest published version: 8.44.0 as of 23 Oct 2026
npm install @orval/core@8.44.0Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 7.19.0, < 7.21.07.21.0npm install @orval/core@7.21.0 -
>= 8.0.0, < 8.2.08.2.0npm install @orval/core@8.2.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can avoid using the x-enum-descriptions field in their OpenAPI specifications until they can update to the patched version. This reduces the attack surface and minimizes the risk of code injection.
Conclusion
The @orval/core package has a critical vulnerability that allows for code injection through unsanitized inputs. Users are strongly advised to update to the latest patched versions to secure their applications. Utilizing tools like Vulert can help monitor for such vulnerabilities effectively.
See every vulnerability recorded for @orval/core →
FAQ
The vulnerability is a code injection flaw that allows attackers to inject arbitrary JavaScript code through unsanitized inputs.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without requiring any signup.
Exploitation of this vulnerability can lead to unauthorized access, execution of malicious commands, and potential compromise of sensitive data.
Yes, the vulnerability has been patched in versions 7.21.0 and 8.2.0 of the @orval/core package.
If immediate updates are not possible, refrain from using the x-enum-descriptions field in your OpenAPI specifications as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for @orval/core.
