CVE Intelligence
Analysis AI-assisted

CVE-2026-25141: Orval: code injection (CWE-94) via incomplete sanitization fix

Orval, a tool that generates TypeScript clients from API specifications, has an incomplete fix for CVE-2026-23947. A limited set of non-alphanumeric characters is still not escaped, which the record says can allow code injection. Fixed versions are 7.21.0 and 8.2.0 according to the CNA description.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

Orval generates type-safe JavaScript clients in TypeScript from API specifications. According to the CNA description, the earlier fix for CVE-2026-23947 was incomplete: some characters are still not escaped by the jsStringEscape function, which can allow code injection (CWE-94).

Impact

  • The NVD record gives a CVSS 3.1 base score of 9.8. GitHub, as CNA, gives a CVSS 4.0 score of 9.3.
  • According to the description, an attacker could force execution of arbitrary JavaScript without needing alphanumeric characters or quotes.
  • The sources do not describe the consequences in a specific deployment. The real impact depends on how generated code is used.

Affected products and versions

  • Orval: versions 7.19.0 up to but not including 7.21.0, and 8.0.0 up to but not including 8.2.0 (7.x and 8.x lines).
  • The fixed versions are 7.21.0 and 8.2.0, according to the CNA description and the Orval v7.21.0 release and Orval v8.2.0 release pages.

Exploitation status

The CISA KEV catalog does not list this CVE. No confirmed exploitation in the wild appears in the sources consulted.

Remediation and mitigation

  • Upgrade Orval to 7.21.0 or later in the 7.x line, or to 8.2.0 or later in the 8.x line.
  • Restrict who can supply the API specifications used to generate clients, and review generated code after regeneration.
  • Rebuild and redeploy projects that depend on Orval after the upgrade.

Detection guidance

  • Inventory projects and build pipelines that use Orval and record the installed versions.
  • Flag builds using versions in the affected ranges for prioritized review.

Limitations of the available information

  • The record contains no EPSS or SSVC data.
  • The fix details come from the CNA description and the cited pages. This analysis did not review the full advisory text.
  • Whether a specific project is exposed depends on its usage, which is unknown.

Frequently asked questions

Which Orval versions are affected by CVE-2026-25141?

According to the affected range in the record, versions from 7.19.0 up to but not including 7.21.0, and from 8.0.0 up to but not including 8.2.0, are affected.

Which versions contain the fix?

The CNA description says versions 7.21.0 and 8.2.0 contain an updated fix. Upgrading is the recommended step for affected projects.

Is this CVE known to be actively exploited?

No. CISA KEV does not list it, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.