Supply Chain Alert: Critical Code Injection Flaw (CVSS 9.3) in Orval

Developers relying on Orval to generate type-safe clients from OpenAPI specifications are being urged to update immediately after a critical code injection flaw was discovered, tracked as CVE-2026-23947, with a CVSS score of 9.3. The flaw lies in how Orval processes certain fields within an OpenAPI specification, allowing untrusted specs to inject arbitrary TypeScript/JavaScript code into generated clients via the x-enum-descriptions field, embedded without proper escaping in getEnumImplementation().

According to security advisory, the injection occurs during const enum generation and can result in executable code within the generated schema files. The issue is described as similar in nature to the recently-patched MCP vulnerability (CVE-2026-22785) but affects a different code path in @orval/core. The Orval npm package has over 2 million downloads each month, and maintainers have released a patch; developers should upgrade to Orval 8.0.2 immediately to ensure their generated clients remain secure.