Critical Code Injection in Orval OpenAPI Client Generator (CVE-2026-23947)

A critical software supply-chain vulnerability, CVE-2026-23947 (CVSS 9.3), was disclosed in Orval, a widely used npm tool that generates type-safe TypeScript/JavaScript clients from OpenAPI/Swagger specifications. The flaw allows code injection when Orval processes untrusted or compromised API specifications: attacker-controlled content in the x-enumDescriptions / x-enum-descriptions field is embedded without proper escaping in getEnumImplementation(), enabling malicious TypeScript/JavaScript to be written into generated client/schema files during const enum generation.

Successful exploitation can lead to arbitrary code execution in environments consuming the generated clients, shifting risk to downstream developers and build/runtime pipelines that treat generated code as trusted. Affected versions are reported as 7.10.0 through 8.0.2, and vendor guidance indicates updating to a fixed release (noted as Orval 8.0.2) to remediate; the issue is described as similar to CVE-2026-22785 but impacting a different @orval/core code path not covered by the earlier fix.