Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
CVE-2026-23947 had an incomplete fix While the current jsStringEscape function properly handles single quotes ('), double quotes (") and other characters, it fails to sanitize and / characters. This allows attackers to break out of JavaScript comment blocks using / sequences and inject arbitrary code into generated files. Example:
Recommended action: Upgrade to 8.2.0 or 7.21.0 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Arbitrary code execution in environments consuming generated clients This issue is similar in nature to the recently-patched MCP vulnerability (CVE-2026-22785), but affects a different code path in @orval/core that was not addressed by that fix. The vulnerability allows untrusted OpenAPI specifications to inject arbitrary TypeScript/JavaScript code into generated clients via the x-enumDescriptions field, which is embedded without proper escaping in getEnumImplementation(). I have confirmed that the injection occurs during const enum generation and results in executable code within the generated schema files. Patches Upgrade to Orval 8.0.2 References An example OpenAPI showing the issue:
Recommended action: Upgrade to 8.0.2 or 7.19.0 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.