CVE-2026-23947
Orval has a code injection via unsanitized x-enum-descriptions in enum generation
Impact
### Impact Arbitrary code execution in environments consuming generated clients This issue is similar in nature to the recently-patched MCP vulnerability (CVE-2026-22785), but affects a different code path in @orval/core that was not addressed by that fix. The vulnerability allows untrusted OpenAPI specifications to inject arbitrary TypeScript/JavaScript code into generated clients via the x-enumDescriptions field, which is embedded without proper escaping in getEnumImplementation(). I have confirmed that the injection occurs during const enum generation and results in executable code within the generated schema files. ### Patches Upgrade to Orval 8.0.2 ### References An example OpenAPI showing the issue: ```yaml openapi: 3.0.4 info: title: Enum PoC version: "1.0.0" paths: /ping: get: operationId: ping responses: "200": description: ok content: application/json: schema: $ref: "#/components/schemas/EvilEnum" components: schemas: EvilEnum: type: string enum: - PWNED x-enumDescriptions: - "pwned */ require('child_process').execSync('id'); /*" ```
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | @orval/core | >= 8.0.0-rc.0, < 8.0.2 | 8.0.2 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Orval | Orval | before 7.19.0 from 8.0.0 before 8.0.2 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/orval-labs/orval/releases/tag/v8.0.2
- https://github.com/orval-labs/orval/security/advisories/GHSA-h526-wf6g-67jv
- https://github.com/advisories/GHSA-h526-wf6g-67jv
- https://nvd.nist.gov/vuln/detail/CVE-2026-23947
- https://github.com/orval-labs/orval/commit/9e5d93533904936678ba93b5d20f6bca176a4e1e
- https://github.com/orval-labs/orval/releases/tag/v7.19.0