CVE-2026-25141

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-25141", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-29T15:39:11.820Z", "datePublished": "2026-01-30T20:19:04.333Z", "dateUpdated": "2026-02-02T18:00:17.681Z"}, "containers": {"cna": {"title": "Orval has a code injection via unsanitized x-enum-descriptions uing JS comments", "problemTypes": [{"descriptions": [{"cweId": "CWE-94", "lang": "en", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 9.3, "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/orval-labs/orval/security/advisories/GHSA-gch2-phqh-fg9q", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/orval-labs/orval/security/advisories/GHSA-gch2-phqh-fg9q"}, {"name": "https://github.com/orval-labs/orval/security/advisories/GHSA-h526-wf6g-67jv", "tags": ["x_refsource_MISC"], "url": "https://github.com/orval-labs/orval/security/advisories/GHSA-h526-wf6g-67jv"}, {"name": "https://github.com/orval-labs/orval/blob/02211fc413524be340ba9ace866a2ef68845ca7c/packages/core/src/utils/string.ts#L227", "tags": ["x_refsource_MISC"], "url": "https://github.com/orval-labs/orval/blob/02211fc413524be340ba9ace866a2ef68845ca7c/packages/core/src/utils/string.ts#L227"}, {"name": "https://github.com/orval-labs/orval/releases/tag/v7.21.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/orval-labs/orval/releases/tag/v7.21.0"}, {"name": "https://github.com/orval-labs/orval/releases/tag/v8.2.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/orval-labs/orval/releases/tag/v8.2.0"}], "affected": [{"vendor": "orval-labs", "product": "orval", "versions": [{"version": ">= 7.19.0, < 7.21.0", "status": "affected"}, {"version": ">= 8.0.0, < 8.2.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-30T20:19:04.333Z"}, "descriptions": [{"lang": "en", "value": "Orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification. Versions starting with 7.19.0 and prior to 7.21.0 and 8.2.0 have an incomplete fix for CVE-2026-23947. While the jsStringEscape function properly handles single quotes ('), double quotes (\") and so on, it is still possible to achieve code injection using only a limited set of characters that are currently not escaped. The vulnerability lies in the fact that the application can be forced to execute arbitrary JavaScript using characters such as []()!+. By using a technique known as JSFuck, an attacker can bypass the current sanitization logic and run arbitrary code without needing any alphanumeric characters or quotes. Version 7.21.0 and 8.2.0 contain an updated fix."}], "source": {"advisory": "GHSA-gch2-phqh-fg9q", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-02T18:00:03.652619Z", "id": "CVE-2026-25141", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-02T18:00:17.681Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-25141", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-02T18:00:03.652619Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-02T18:00:12.943Z"}}], "cna": {"title": "Orval has a code injection via unsanitized x-enum-descriptions uing JS comments", "source": {"advisory": "GHSA-gch2-phqh-fg9q", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 9.3, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "orval-labs", "product": "orval", "versions": [{"status": "affected", "version": ">= 7.19.0, < 7.21.0"}, {"status": "affected", "version": ">= 8.0.0, < 8.2.0"}]}], "references": [{"url": "https://github.com/orval-labs/orval/security/advisories/GHSA-gch2-phqh-fg9q", "name": "https://github.com/orval-labs/orval/security/advisories/GHSA-gch2-phqh-fg9q", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/orval-labs/orval/security/advisories/GHSA-h526-wf6g-67jv", "name": "https://github.com/orval-labs/orval/security/advisories/GHSA-h526-wf6g-67jv", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/orval-labs/orval/blob/02211fc413524be340ba9ace866a2ef68845ca7c/packages/core/src/utils/string.ts#L227", "name": "https://github.com/orval-labs/orval/blob/02211fc413524be340ba9ace866a2ef68845ca7c/packages/core/src/utils/string.ts#L227", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/orval-labs/orval/releases/tag/v7.21.0", "name": "https://github.com/orval-labs/orval/releases/tag/v7.21.0", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/orval-labs/orval/releases/tag/v8.2.0", "name": "https://github.com/orval-labs/orval/releases/tag/v8.2.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification. Versions starting with 7.19.0 and prior to 7.21.0 and 8.2.0 have an incomplete fix for CVE-2026-23947. While the jsStringEscape function properly handles single quotes ('), double quotes (\") and so on, it is still possible to achieve code injection using only a limited set of characters that are currently not escaped. The vulnerability lies in the fact that the application can be forced to execute arbitrary JavaScript using characters such as []()!+. By using a technique known as JSFuck, an attacker can bypass the current sanitization logic and run arbitrary code without needing any alphanumeric characters or quotes. Version 7.21.0 and 8.2.0 contain an updated fix."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-30T20:19:04.333Z"}}}, "cveMetadata": {"cveId": "CVE-2026-25141", "state": "PUBLISHED", "dateUpdated": "2026-02-02T18:00:17.681Z", "dateReserved": "2026-01-29T15:39:11.820Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-30T20:19:04.333Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "orval", "vendor": "orval-labs", "versions": [{"status": "affected", "version": ">= 7.19.0, < 7.21.0"}, {"status": "affected", "version": ">= 8.0.0, < 8.2.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:orval:orval:*:*:*:*:*:*:*:*", "matchCriteriaId": "5556B1C2-D618-454E-A218-A1C555204D25", "versionEndExcluding": "7.21.0", "versionStartIncluding": "7.19.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:orval:orval:*:*:*:*:*:*:*:*", "matchCriteriaId": "B4295F68-11B1-4DC8-AF44-570321BD85B1", "versionEndExcluding": "8.2.0", "versionStartIncluding": "8.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification. Versions starting with 7.19.0 and prior to 7.21.0 and 8.2.0 have an incomplete fix for CVE-2026-23947. While the jsStringEscape function properly handles single quotes ('), double quotes (\") and so on, it is still possible to achieve code injection using only a limited set of characters that are currently not escaped. The vulnerability lies in the fact that the application can be forced to execute arbitrary JavaScript using characters such as []()!+. By using a technique known as JSFuck, an attacker can bypass the current sanitization logic and run arbitrary code without needing any alphanumeric characters or quotes. Version 7.21.0 and 8.2.0 contain an updated fix."}, {"lang": "es", "value": "Orval genera clientes JS con seguridad de tipos (TypeScript) a partir de cualquier especificaci\u00f3n OpenAPI v3 o Swagger v2 v\u00e1lida. Las versiones a partir de la 7.19.0 y anteriores a la 7.21.0 y 8.2.0 tienen una correcci\u00f3n incompleta para CVE-2026-23947. Si bien la funci\u00f3n jsStringEscape maneja correctamente las comillas simples ('), las comillas dobles (\") y dem\u00e1s, a\u00fan es posible lograr la inyecci\u00f3n de c\u00f3digo utilizando solo un conjunto limitado de caracteres que actualmente no est\u00e1n escapados. La vulnerabilidad reside en el hecho de que la aplicaci\u00f3n puede ser forzada a ejecutar JavaScript arbitrario utilizando caracteres como []()!+. Al utilizar una t\u00e9cnica conocida como JSFuck, un atacante puede eludir la l\u00f3gica de saneamiento actual y ejecutar c\u00f3digo arbitrario sin necesidad de caracteres alfanum\u00e9ricos o comillas. Las versiones 7.21.0 y 8.2.0 contienen una correcci\u00f3n actualizada."}], "id": "CVE-2026-25141", "lastModified": "2026-06-17T10:24:10.760", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25141", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-02-02T18:00:03.652619Z", "version": "2.0.3"}}]}, "published": "2026-01-30T21:15:58.603", "references": [{"source": "security-advisories@github.com", "tags": ["Product"], "url": "https://github.com/orval-labs/orval/blob/02211fc413524be340ba9ace866a2ef68845ca7c/packages/core/src/utils/string.ts#L227"}, {"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/orval-labs/orval/releases/tag/v7.21.0"}, {"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/orval-labs/orval/releases/tag/v8.2.0"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/orval-labs/orval/security/advisories/GHSA-gch2-phqh-fg9q"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/orval-labs/orval/security/advisories/GHSA-h526-wf6g-67jv"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T01:02:56.020573+00:00", "value": {"mitigation_remediation": ["Upgrade Orval to version 7.21.0 or later, or to 8.2.0 or later, which contain the complete fix for this injection issue.", "If an upgrade is not immediately possible, locate the jsStringEscape function in the codebase and apply the patch that properly escapes all special characters used in JSFuck expressions.", "Validate or sanitize all x\u2011enum\u2011descriptions values in incoming OpenAPI specifications to ensure they do not contain characters that can form a malicious JavaScript expression."], "summary": {"action": "Immediate Patch", "impact": "Arbitrary JavaScript code execution via code injection"}, "threat_synthesis": {"affected_systems": "The affected product is Orval from orval-labs. Versions 7.19.0 through 7.20.x and 8.0.0 through 8.1.x are vulnerable, as these released before the comprehensive fix that appears in 7.21.0 and 8.2.0. All earlier or later releases are not impacted unless they contain the same escape logic.", "description_and_impact": "This vulnerability allows an attacker to inject arbitrary JavaScript into the code generated by Orval. By supplying specially crafted values in the x\u2011enum\u2011descriptions field of an OpenAPI specification, the unsanitized string builder can be made to produce a JSFuck expression that bypasses the existing escape logic. The resulting injected code is then executed in the context where the generated client is used, potentially yielding full control of the application running the client. The flaw is a classic code\u2011injection weakness (CWE\u201194) and can compromise confidentiality, integrity, and availability if the generated code is deployed in a trusted environment.", "risk_and_exploitability": "The CVSS v3.1 base score of 9.3 indicates high severity, while the EPSS score of less than 1% shows a very low likelihood that the flaw is being exploited in the wild at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker who can supply or influence a malformed OpenAPI specification that is processed by Orval, such as a compromised CI pipeline or malicious code generator. Once the vulnerable code is generated, arbitrary JavaScript can run in the browser or Node.js environment where the client is loaded."}}}}, "created": "2026-02-02T09:27:10.783829+00:00", "updated": "2026-04-18T01:15:05.979186+00:00", "vendors": ["orval-labs", "orval-labs$PRODUCT$orval"]}