Vulnerabilities

TI-2026-20303 CVE-2026-25141 · GHSA-gch2-phqh-fg9q

Orval has a code injection via unsanitized x-enum-descriptions uing JS comments

MEDIUM 49

Orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.0069 Published 2026-01-30 Fixed in 7.21.0, 8.2.0 CWE-94

TI-2026-19450 CVE-2026-24132 · GHSA-f456-rf33-4626

LOW 37

Orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification.

CVSS 4.0HIGH 7.7 Network No auth User interaction EPSS 0.00743 Published 2026-01-22 Fixed in 7.20.0, 8.0.3 CWE-77

TI-2026-19289 CVE-2026-23947 · GHSA-h526-wf6g-67jv

MEDIUM 50

Orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00839 Published 2026-01-20 Fixed in 8.0.2, 7.19.0 CWE-77

TI-2026-18303 CVE-2026-22785 · GHSA-mwr6-3gp8-9jmj

MEDIUM 49

orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00778 Published 2026-01-12 Fixed in 7.18.0 CWE-77