Poisoned Comments: Critical Orval Flaw (CVE-2026-25141) Injects Code

A critical vulnerability has been discovered in Orval, a popular developer tool used to generate type-safe TypeScript clients from OpenAPI specifications. The flaw, tracked as CVE-2026-25141, carries a critical severity score of 9.3 and exposes millions of projects to code injection attacks through a seemingly harmless mechanism: software comments.

Orval is a staple in the modern web development stack, boasting over 2.8 million downloads every month. It automates the tedious process of creating API clients by reading OpenAPI (formerly Swagger) definition files in YAML or JSON format. However, security researchers have found that this automation can be weaponized.

The vulnerability lies in how Orval handles x-enum-descriptions—a field used in OpenAPI specs to describe values in an enumeration. When generating TypeScript code, Orval takes these descriptions and embeds them as JavaScript comments to help developers understand the code.

The issue, according to the security advisory, is a failure to properly sanitize these inputs:

“While the current jsStringEscape function properly handles single quotes (‘), double quotes (“) and other characters, it fails to sanitize * and / characters.”

This oversight allows an attacker to craft a malicious OpenAPI specification. By inserting the sequence */ into a description field, they can prematurely close the comment block. Once the comment is closed, any subsequent text is interpreted by the compiler as executable JavaScript or TypeScript code.

This isn’t the first time Orval has faced this specific type of threat. The advisory notes that CVE-2026-25141 is actually a bypass of a previous patch for CVE-2026-23947, which had an “incomplete fix.”

This means that developers who thought they were safe after updating might still be vulnerable if they are running versions >= 7.19.0.

The implications of this vulnerability are significant. If an attacker can convince a developer to generate a client from a malicious or compromised OpenAPI spec, they can inject arbitrary code into the victim’s application. This code would run with the same privileges as the application itself, potentially stealing environment variables, API keys, or user data.

The maintainers have released patches to address this critical flaw. Developers using Orval are strongly urged to upgrade immediately to the patched versions:

• 7.21.0
• 8.2.0

Given the popularity of the package and the ease of exploitation, security teams should prioritize auditing their development pipelines to ensure the vulnerable versions are no longer in use.

Related Posts:

• Supply Chain Alert: Critical Code Injection Flaw (CVSS 9.3) in Orval
• Tax Extension Malware Campaign Exploits Trusted GitHub Repositories to Deliver Remcos RAT
• Critical W3 Total Cache Flaw (CVE-2025-9501, CVSS 9.0) Risks Unauthenticated RCE on 1 Million WordPress Sites
• Itch.io Targeted: Lumma Stealer Deployed Via Fake Updates and Reflective Node.js Loader