Is CVE-2026-25141 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-25141 being exploited in the wild.

How severe is CVE-2026-25141?

Medium severity, with a CVSS score of 4, published 30 January 2026.

Which products and versions are affected?

@orval/core (npm) SEMVER:introduced=7.19.0,fixed=7.21.0.

Is there a fix for CVE-2026-25141?

Yes. @orval/core (npm): upgrade to 7.21.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-25141 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-25141?

Check whether you run @orval/core (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-25141: Orval code injection in x-enum-descriptions via unsanitized JS comments

CVE-2026-25141 · Severity: medium · CVSS 4 · Published 2026-01-30

Orval is a code generation tool that creates API client code from OpenAPI specifications. An incomplete fix for a prior vulnerability leaves the tool susceptible to code injection attacks through malicious enum descriptions in API specs. An attacker who controls the OpenAPI definition can inject arbitrary JavaScript code into the generated files, potentially leading to execution of malicious commands on developers' machines during code generation.

Vendors: npm.

Quick answers

Is CVE-2026-25141 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-25141 being exploited in the wild.
How severe is CVE-2026-25141?: Medium severity, with a CVSS score of 4, published 30 January 2026.
Which products and versions are affected?: @orval/core (npm) SEMVER:introduced=7.19.0,fixed=7.21.0.
Is there a fix for CVE-2026-25141?: Yes. @orval/core (npm): upgrade to 7.21.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-25141 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-25141?: Check whether you run @orval/core (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@orval/core (npm): upgrade to 7.21.0 or later
```
npm install @orval/core@7.21.0
```

Technical details

This vulnerability is a code injection flaw in the jsStringEscape sanitization function used when processing x-enum-descriptions from OpenAPI specifications. The function properly escapes single and double quotes but fails to sanitize asterisk (*) and forward slash (/) characters. This allows attackers to break out of JavaScript comment blocks using */ sequences and inject arbitrary code. An attacker-controlled OpenAPI spec with malicious x-enumDescriptions can inject code (including operating system commands via child_process imports) that executes during code generation. The vulnerability requires the attacker to control or influence the OpenAPI specification being processed, but no additional authentication or user interaction beyond code generation is needed. Patches are available in version 7.21.0 and later.

Affected products

Orval Labs Orval >=7.19.0, <7.21.0

Identifiers

CVE-2026-25141
GHSA-gch2-phqh-fg9q

Timeline

2026-01-30: disclosed
2026-01-30: patched: Version 7.21.0 and later

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.