VulnerabilityAnalyzed

CVE-2026-25141

While the jsStringEscape function properly handles single quotes ('), double quotes (") and so on, it is still possible to achieve code injection using only a limited set of characters that are currently not escaped.

CRITICAL 9.3EPSS 0.61%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.61%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification. Versions starting with 7.19.0 and prior to 7.21.0 and 8.2.0 have an incomplete fix for CVE-2026-23947. While the jsStringEscape function properly handles single quotes ('), double quotes (") and so on, it is still possible to achieve code injection using only a limited set of characters that are currently not escaped. The vulnerability lies in the fact that the application can be forced to execute arbitrary JavaScript using characters such as []()!+. By using a technique known as JSFuck, an attacker can bypass the current sanitization logic and run arbitrary code without needing any alphanumeric characters or quotes. Version 7.21.0 and 8.2.0 contain an updated fix.

CVSS 4.0: 9.3 CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.61% probability · 47th percentile
CISA KEV: Not listed
Weakness: CWE-94
Affected: orval/orval
Source: security-advisories@github.com

References

https://github.com/orval-labs/orval/blob/02211fc413524be340ba9ace866a2ef68845ca7c/packages/core/src/utils/string.ts#L227Product
https://github.com/orval-labs/orval/releases/tag/v7.21.0Product, Release Notes
https://github.com/orval-labs/orval/releases/tag/v8.2.0Product, Release Notes
https://github.com/orval-labs/orval/security/advisories/GHSA-gch2-phqh-fg9qVendor Advisory
https://github.com/orval-labs/orval/security/advisories/GHSA-h526-wf6g-67jvVendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.