CVE-2026-25141: Orval OpenAPI RCE Vulnerability

CVE-2026-25141 Overview

CVE-2026-25141 is a critical code injection vulnerability affecting Orval, a tool that generates type-safe JavaScript clients (TypeScript) from OpenAPI v3 or Swagger v2 specifications. This vulnerability represents an incomplete fix for the previous CVE-2026-23947, where the jsStringEscape function's sanitization logic can be bypassed using a technique known as JSFuck to achieve arbitrary JavaScript execution.

The vulnerability stems from insufficient character escaping in the string sanitization function. While the jsStringEscape function properly handles common dangerous characters like single quotes ('), double quotes ("), and backslashes, it fails to account for the limited character set []()!+ that can be used to construct arbitrary JavaScript expressions through JSFuck encoding.

Critical Impact

Remote attackers can bypass sanitization controls to execute arbitrary JavaScript code during client generation, potentially compromising developer environments and CI/CD pipelines without requiring alphanumeric characters or quotes.

Affected Products

• Orval versions 7.19.0 through 7.20.x
• Orval versions 8.0.0 through 8.1.x

Discovery Timeline

• 2026-01-30 - CVE CVE-2026-25141 published to NVD
• 2026-02-04 - Last updated in NVD database

Technical Details for CVE-2026-25141

Vulnerability Analysis

This vulnerability is classified under CWE-94 (Improper Control of Generation of Code - Code Injection). The core issue lies in the incomplete remediation of CVE-2026-23947, where developers implemented escape handling for traditional injection characters but overlooked the possibility of constructing valid JavaScript using only non-alphanumeric characters.

The jsStringEscape function in Orval's core string utilities was designed to sanitize user-controlled input from OpenAPI specifications before incorporating it into generated TypeScript client code. However, the sanitization approach focused on escaping quote characters and backslashes while leaving characters like brackets [], parentheses (), exclamation marks !, and plus signs + untouched.

JSFuck is an esoteric programming technique that exploits JavaScript's type coercion rules to write valid code using only six characters: [, ], (, ), !, and +. By leveraging JavaScript's automatic type conversion, attackers can encode any JavaScript code without using letters, numbers, or quote characters. This allows complete bypass of the current sanitization logic.

When a malicious OpenAPI specification containing JSFuck-encoded payloads is processed by vulnerable Orval versions, the encoded JavaScript executes during the client generation phase. This could occur in developer workstations or automated CI/CD pipelines that process untrusted API specifications.

Root Cause

The root cause is an allowlist-based approach to character escaping that failed to anticipate alternative code construction methods. The jsStringEscape function explicitly handles known dangerous characters but does not implement a strict allowlist of permitted characters. The function at /packages/core/src/utils/string.ts#L227 performs targeted escaping rather than comprehensive input validation, leaving the JSFuck character set ([]()!+) available for exploitation.

Attack Vector

The attack vector requires network access where an attacker can supply a malicious OpenAPI specification to a system running vulnerable Orval versions. The attack does not require authentication or user interaction, making it particularly dangerous in automated processing scenarios.

An attacker crafts an OpenAPI v3 or Swagger v2 specification containing JSFuck-encoded JavaScript payloads in fields that get processed by the jsStringEscape function. When Orval processes this specification to generate TypeScript clients, the encoded payload bypasses sanitization and executes arbitrary code. For example, a JSFuck encoding of alert(1) uses only the characters []()!+ and evaluates to the same result when interpreted by JavaScript.

The attack is particularly concerning for organizations that automatically generate API clients from external or third-party API specifications, as the malicious payload would execute during the build process with the permissions of the executing user or service account.

Detection Methods for CVE-2026-25141

Indicators of Compromise

• Presence of unusual character sequences containing only []()!+ in OpenAPI specification files
• Unexpected JavaScript execution or process spawning during Orval code generation
• Modified or unexpected files created during API client generation processes
• Anomalous network connections originating from build processes running Orval

Detection Strategies

• Implement static analysis scanning of OpenAPI specifications for JSFuck patterns before processing
• Monitor CI/CD pipeline logs for unusual activity during Orval execution phases
• Deploy application-level logging to capture input specifications processed by Orval
• Use file integrity monitoring on generated client code directories to detect unexpected modifications

Monitoring Recommendations

• Configure security monitoring for build servers and developer workstations running Orval
• Establish baseline behavior for code generation processes to identify anomalies
• Implement alerting on process creation events during automated API client generation
• Review and audit external API specifications before incorporating them into build pipelines

How to Mitigate CVE-2026-25141

Immediate Actions Required

• Upgrade Orval to version 7.21.0 or 8.2.0 immediately to apply the complete fix
• Audit all OpenAPI specifications currently in use for potentially malicious content
• Review CI/CD pipeline configurations that process untrusted API specifications
• Temporarily disable automated processing of external API specifications until patches are applied

Patch Information

The Orval development team has released patched versions that address this code injection bypass vulnerability. The fix includes comprehensive sanitization that accounts for the JSFuck character set and other non-alphanumeric code construction techniques.

For additional technical details and security information, refer to the GitHub Security Advisory GHSA-gch2-phqh-fg9q and the related advisory GHSA-h526-wf6g-67jv.

Workarounds

• Implement pre-processing validation of OpenAPI specifications to reject inputs containing JSFuck character patterns
• Run Orval in isolated container environments with minimal permissions to limit exploitation impact
• Establish a trusted specification review process before processing any external API definitions
• Consider using network segmentation to restrict build environment access to sensitive resources

# Example: Update Orval to patched version
npm update @orval/core@7.21.0
# or for version 8.x
npm update @orval/core@8.2.0

# Verify installed version
npm list @orval/core