CVE-2026-23947: Orval OpenAPI Client RCE Vulnerability

CVE-2026-23947 Overview

CVE-2026-23947 is an arbitrary code execution vulnerability in Orval, a popular tool that generates type-safe JavaScript/TypeScript clients from OpenAPI v3 or Swagger v2 specifications. The vulnerability allows attackers to inject malicious TypeScript/JavaScript code into generated clients through crafted OpenAPI specifications, specifically via the x-enumDescriptions field which is processed without proper input sanitization.

This vulnerability is similar in nature to CVE-2026-22785 but affects a different code path in @orval/core that was not addressed by the previous fix. The injection occurs during const enum generation within the getEnumImplementation() function, resulting in executable code being embedded within generated schema files.

Critical Impact

Attackers can achieve arbitrary code execution in any environment that consumes clients generated from malicious OpenAPI specifications, potentially compromising build pipelines, development environments, and production systems.

Affected Products

• Orval versions prior to 7.19.0
• Orval versions 7.19.0 through 8.0.1
• @orval/core package (affected code path in getEnumImplementation())

Discovery Timeline

• January 20, 2026 - CVE-2026-23947 published to NVD
• January 21, 2026 - Last updated in NVD database

Technical Details for CVE-2026-23947

Vulnerability Analysis

The vulnerability stems from improper input validation (CWE-77: Command Injection) in the Orval code generation pipeline. When processing OpenAPI specifications, Orval extracts values from the x-enumDescriptions extension field and embeds them directly into the generated TypeScript code without adequate sanitization or escaping.

The affected function getEnumImplementation() in the @orval/core package constructs const enum declarations by concatenating user-controlled input from the OpenAPI specification. Because the x-enumDescriptions field contents are not properly escaped before being embedded into the generated code, an attacker can craft a malicious OpenAPI specification that breaks out of the expected string context and injects arbitrary JavaScript or TypeScript code.

This represents a supply chain risk where a compromised or malicious OpenAPI specification can introduce arbitrary code execution at multiple points: during development when the client is generated, during build processes in CI/CD pipelines, and at runtime when the generated code is executed.

Root Cause

The root cause is insufficient input sanitization in the getEnumImplementation() function within @orval/core. The function fails to properly escape or validate content from the x-enumDescriptions field before embedding it into generated TypeScript code. This allows specially crafted content to break out of the intended string literal context and inject executable code that will run when the generated file is processed by TypeScript/JavaScript tooling or executed at runtime.

Attack Vector

The attack requires an adversary to provide a malicious OpenAPI specification to a target system running Orval for client generation. This can occur through several scenarios:

• A developer unknowingly processes a compromised third-party API specification
• An attacker with access to modify API specifications in a shared repository
• A supply chain attack through a dependency that provides OpenAPI specifications
• Internal compromise where an attacker modifies legitimate specifications

When the victim runs Orval against the malicious specification, the injected code is embedded into the generated TypeScript files. This code then executes when the generated files are compiled or run, potentially allowing the attacker to steal credentials, exfiltrate data, establish persistence, or perform lateral movement within the compromised environment.

The vulnerability mechanism exploits insufficient escaping in the enum generation code path. When the x-enumDescriptions field contains specially crafted content with string escape sequences or code injection payloads, the generated output breaks out of the intended string context and introduces arbitrary executable statements. For detailed technical information, see the GitHub Security Advisory.

Detection Methods for CVE-2026-23947

Indicators of Compromise

• Unexpected or suspicious code patterns in generated Orval client files, particularly within enum definitions
• Generated schema files containing unusual string patterns, function calls, or import statements not typical of Orval output
• Build process failures or unexpected behavior after processing new or updated OpenAPI specifications
• Unusual network activity or process execution originating from build environments or applications using generated clients

Detection Strategies

• Review generated TypeScript/JavaScript files for anomalous code patterns, especially in enum implementations
• Implement pre-generation validation of OpenAPI specifications to detect suspicious x-enumDescriptions content
• Use static analysis tools to scan generated code for injection patterns or unexpected executable statements
• Monitor build and development environments for unusual behavior following Orval client generation

Monitoring Recommendations

• Audit all OpenAPI specifications before processing with Orval, especially those from external or untrusted sources
• Implement file integrity monitoring on generated client directories to detect unexpected changes
• Log and alert on Orval execution events, particularly when processing specifications from new sources
• Review generated code as part of code review processes before committing to version control

How to Mitigate CVE-2026-23947

Immediate Actions Required

• Upgrade Orval to version 7.19.0 or 8.0.2 immediately, as these versions contain the security fix
• Audit all previously generated clients for signs of code injection, particularly in enum implementations
• Review OpenAPI specifications from external sources before processing
• Regenerate all clients using a patched version of Orval after upgrading

Patch Information

The Orval development team has released patched versions that address this vulnerability. Version 7.19.0 addresses the issue for the 7.x branch, while version 8.0.2 provides the fix for the 8.x branch. The patches implement proper escaping and sanitization of the x-enumDescriptions field content before embedding it into generated code.

For detailed release information, see the GitHub Release v8.0.2. The complete security advisory is available at GitHub Security Advisory GHSA-h526-wf6g-67jv.

Workarounds

• Avoid processing untrusted OpenAPI specifications until the upgrade is complete
• Manually review and validate all x-enumDescriptions fields in OpenAPI specifications before generation
• Implement a validation layer that strips or sanitizes potentially dangerous content from specification files
• Consider using isolated build environments with limited network access and permissions when generating clients from external specifications

# Upgrade Orval to patched version
npm update orval@8.0.2
# or for yarn users
yarn upgrade orval@8.0.2