CVE-2026-25141

npm/@orval/core CVE-2026-25141: critical, EPSS 0.69%

Orval has Code Injection via unsanitized x-enum-descriptions using JS comments

Action: Upgrade @orval/core to 7.21.0 or later.

npm i @orval/core@7.21.0

npm i @orval/core@8.2.0

Affected

Fixed versions

Sources

• osv: GHSA-gch2-phqh-fg9q
• https://github.com/orval-labs/orval/security/advisories/GHSA-gch2-phqh-fg9q
• https://github.com/orval-labs/orval/security/advisories/GHSA-h526-wf6g-67jv
• https://nvd.nist.gov/vuln/detail/CVE-2026-25141
• https://github.com/orval-labs/orval
• https://github.com/orval-labs/orval/blob/02211fc413524be340ba9ace866a2ef68845ca7c/packages/core/src/utils/string.ts#L227
• https://github.com/orval-labs/orval/releases/tag/v7.21.0
• https://github.com/orval-labs/orval/releases/tag/v8.2.0

CVE-2026-25141 · published 2026-01-30T21:17:25Z · modified 2026-02-04T04:11:35.636982Z · JSON