CVE-2026-23947
📋 TL;DR
Orval versions 7.19.0 through 8.0.2 contain a code injection vulnerability in the x-enumDescriptions field processing. Untrusted OpenAPI specifications can inject arbitrary TypeScript/JavaScript code into generated clients, leading to remote code execution. This affects any environment using Orval to generate clients from untrusted OpenAPI specifications.
💻 Affected Systems
- Orval
📦 What is this software?
Orval by Orval
Orval by Orval
⚠️ Risk & Real-World Impact
Worst Case
Full remote code execution on systems generating or using the compromised client code, potentially leading to complete system compromise.
Likely Case
Arbitrary code execution in development/build environments when processing malicious OpenAPI specifications.
If Mitigated
Limited impact if only trusted OpenAPI specifications are processed and proper input validation is in place.
🎯 Exploit Status
Exploitation requires providing a malicious OpenAPI specification to Orval's client generation process.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 7.19.0 and 8.0.2
Vendor Advisory: https://github.com/orval-labs/orval/security/advisories/GHSA-h526-wf6g-67jv
Restart Required: No
Instructions:
1. Update Orval to version 7.19.0 or 8.0.2. 2. Regenerate any previously generated clients from potentially untrusted OpenAPI specifications.
🔧 Temporary Workarounds
Input Validation
allValidate and sanitize all OpenAPI specifications before processing with Orval
Trusted Sources Only
allOnly process OpenAPI specifications from trusted, verified sources
🧯 If You Can't Patch
- Implement strict input validation for all OpenAPI specifications
- Isolate Orval client generation to sandboxed environments
🔍 How to Verify
Check if Vulnerable:
Check Orval version: if using version <7.19.0 or between 7.19.0 and 8.0.2 (excluding 8.0.2), you are vulnerable.Check Version:
npm list orvalVerify Fix Applied:
Verify Orval version is 7.19.0 or 8.0.2, and regenerate any clients from potentially untrusted sources.📡 Detection & Monitoring
Log Indicators:
- Unusual code generation patterns
- Suspicious content in x-enumDescriptions fields
Network Indicators:
- Downloads of OpenAPI specifications from untrusted sources
SIEM Query:
Search for process execution from Orval client generation with suspicious parameters