Orval CVE-2026-23947

orval (TypeScript API client generator) before 7.18.0 has code injection via OpenAPI specification summary fields in MCP

Orval TypeScript code generator versions 7.19+ have a command injection vulnerability allowing RCE through malicious Ope

Code injection in Orval TypeScript API client generator versions 7.19.0 to before 7.22.0. Generated client code may be v

Arbitrary code execution in Orval before 8.21.0 arises when the code generator emits an unescaped backtick (or ${...}) f

Arbitrary code execution in Orval (orval-labs/orval) before 8.21.0 allows an attacker who controls an OpenAPI v3 or Swag

Code injection in Orval, a TypeScript/JavaScript API client generator, allows a malicious OpenAPI v3 or Swagger v2 speci

Code execution in Orval before 8.21.0 occurs when its zod schema generator processes an attacker-controlled OpenAPI v3 o

Code injection in Orval before 8.21.0 lets an attacker-controlled OpenAPI v3 / Swagger v2 specification achieve arbitrar

Arbitrary code execution in Orval (OpenAPI/Swagger TypeScript client generator) before 8.21.0 lets an attacker who contr

Code injection in Orval (orval-labs/orval) before 8.21.0 allows an attacker who controls an OpenAPI v3 or Swagger v2 spe

Code injection in Orval, a TypeScript client generator for OpenAPI v3 and Swagger v2 specs, allows arbitrary JavaScript

Code injection in Orval before 8.21.0 lets an attacker-controlled OpenAPI v3 or Swagger v2 specification execute arbitra