Code Injection Vulnerability in Orval TypeScript Client Generator
CVE-2026-25141
9.3CRITICAL
What is CVE-2026-25141?
The Orval TypeScript client generator versions from 7.19.0 to prior 7.21.0 and 8.2.0 have a vulnerability allowing potential code injection. Although the jsStringEscape function correctly manages certain characters, attackers can exploit a limited set of unescaped characters, using techniques such as JSFuck to execute arbitrary JavaScript. This flaw underscores the importance of regular updates; versions 7.21.0 and 8.2.0 include necessary patches to mitigate the risks.
Affected Version(s)
orval >= 7.19.0, < 7.21.0 < 7.19.0, 7.21.0
orval >= 8.0.0, < 8.2.0 < 8.0.0, 8.2.0